The Events Calendar plugin for WordPress versions up to and including 6.15.9 contains an information disclosure vulnerability. This flaw arises from the sysinfo REST endpoint using a loose comparison for the opt-in key, allowing unauthenticated attackers to bypass authentication by sending a boolean value. The vulnerability is only exploitable if the setting to automatically share system information with The Events Calendar support team is enabled.