Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-2694 The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' a… https://www.cve.org/CVERecord?id=CVE-2026-2694
Post summary
CVE-2026-2694 exposes The Events Calendar plugin for WordPress to unauthorized data modification and loss because of an improper capability check on the 'can_edit' feature.
CVE-2026-2694 Unauthorized Event Modification in The Events Calendar WordPress Plugin Before 6.15.16 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2694
Post summary
A new CVE (CVE-2026-2694) has been disclosed, indicating unauthorized event modification in The Events Calendar WordPress plugin before version 6.15.16.