CVE-2026-84745: CWE-200 Information Exposure in The Events Calendar

CVE-2026-84745 is an information exposure vulnerability in The Events Calendar WordPress plugin prior to version 6.17.3.1. The plugin fails to restrict access to non-public content on its public REST API endpoints, enabling users with low privileges (e.g., contributors) to access the full contents of unpublished records belonging to other users. This vulnerability is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 base score is 2.7, reflecting low impact primarily on confidentiality with no integrity or availability impact. There is no explicit vendor advisory or patch link provided in the data, and the plugin is not a cloud service.

Users with low-privilege roles can access unpublished content that should be restricted, potentially exposing sensitive or private information. The impact is limited to confidentiality with no reported effects on integrity or availability. The low CVSS score indicates a limited security risk under typical conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles carefully and avoid assigning low-privilege roles to untrusted users. Monitor official sources for updates and apply any released patches promptly.