Description
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | The Events Calendar | 4.5 – < 6.17.5 | 6.17.5 |
References
- https://wpscan.com/vulnerability/0f34a90e-3d8b-4a87-a2ed-fe4d2c481732/ exploit vdb-entry technical-description