CVE-2026-13390

MEDIUM

The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation

Title source: cna

Description

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/c7d3b1c5-3b3a-4359-aa41-0dfccb091fa4/

Scores

CVSS v3 5.3

EPSS 0.0018

EPSS Percentile 8.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

None/The Events Calendar < 6.16.5.1

Published Jul 27, 2026

Tracked Since Jul 27, 2026