{"id":"CVE-2026-84745","title":"The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full content…","summary":"The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full content…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84745","references":[{"url":"https://wpscan.com/vulnerability/cf23ee00-322c-4443-a50d-a91f90d179aa/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00189,"epssPercentile":0.08758,"ingestedAt":"2026-09-06T06:51:17.374Z","slug":"CVE-2026-84745","body":"## Overview\n\nThe Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8284,"id":"CVE-2026-84745","ts":1788919996095,"field":"cvss","old":null,"new":"2.7"},{"seq":8283,"id":"CVE-2026-84745","ts":1788919996095,"field":"severity","old":"none","new":"low"},{"seq":8093,"id":"CVE-2026-84745","ts":1788919281418,"field":"cvss","old":"2.7","new":null},{"seq":8092,"id":"CVE-2026-84745","ts":1788919281418,"field":"severity","old":"low","new":"none"},{"seq":7902,"id":"CVE-2026-84745","ts":1788916357308,"field":"cvss","old":null,"new":"2.7"},{"seq":7901,"id":"CVE-2026-84745","ts":1788916357308,"field":"severity","old":"none","new":"low"},{"seq":7711,"id":"CVE-2026-84745","ts":1788915298586,"field":"cvss","old":"2.7","new":null},{"seq":7710,"id":"CVE-2026-84745","ts":1788915298586,"field":"severity","old":"low","new":"none"},{"seq":7520,"id":"CVE-2026-84745","ts":1788912717826,"field":"cvss","old":null,"new":"2.7"},{"seq":7519,"id":"CVE-2026-84745","ts":1788912717826,"field":"severity","old":"none","new":"low"},{"seq":7329,"id":"CVE-2026-84745","ts":1788911331881,"field":"cvss","old":"2.7","new":null},{"seq":7328,"id":"CVE-2026-84745","ts":1788911331881,"field":"severity","old":"low","new":"none"},{"seq":7133,"id":"CVE-2026-84745","ts":1788909079434,"field":"cvss","old":null,"new":"2.7"},{"seq":7132,"id":"CVE-2026-84745","ts":1788909079434,"field":"severity","old":"none","new":"low"},{"seq":6945,"id":"CVE-2026-84745","ts":1788907391939,"field":"cvss","old":"2.7","new":null},{"seq":6944,"id":"CVE-2026-84745","ts":1788907391939,"field":"severity","old":"low","new":"none"},{"seq":6747,"id":"CVE-2026-84745","ts":1788905445294,"field":"cvss","old":null,"new":"2.7"},{"seq":6746,"id":"CVE-2026-84745","ts":1788905445294,"field":"severity","old":"none","new":"low"},{"seq":6565,"id":"CVE-2026-84745","ts":1788903460154,"field":"cvss","old":"2.7","new":null},{"seq":6564,"id":"CVE-2026-84745","ts":1788903460154,"field":"severity","old":"low","new":"none"},{"seq":6351,"id":"CVE-2026-84745","ts":1788901811341,"field":"cvss","old":null,"new":"2.7"},{"seq":6350,"id":"CVE-2026-84745","ts":1788901811341,"field":"severity","old":"none","new":"low"},{"seq":6181,"id":"CVE-2026-84745","ts":1788899562526,"field":"cvss","old":"2.7","new":null},{"seq":6180,"id":"CVE-2026-84745","ts":1788899562526,"field":"severity","old":"low","new":"none"},{"seq":6049,"id":"CVE-2026-84745","ts":1788898240548,"field":"cvss","old":null,"new":"2.7"},{"seq":6048,"id":"CVE-2026-84745","ts":1788898240548,"field":"severity","old":"none","new":"low"}]}