Vulnerability · Published Jul 27, 2026 · Assigned by WPScan
CVE-2026-13390The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
Medium 5.3
In plain English
A medium-severity missing authorization in The Events Calendar from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | The Events Calendar | 0 – before 6.16.5.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/c7d3b1c5-3b3a-4359-aa41-0dfccb091fa4/ exploit, vdb-entry, technical-description