CVE-2026-13390
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
| Vendor | unknown |
| Product | the events calendar |
| Published | Jul 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown the events calendar
Be the first to know when new unknown vulnerabilities affecting unknown the events calendar are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / The Events Calendar
0 < 6.16.5.1
References
Credits
Haitam Lazaar WPScan