CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.11.2.1.
Explanation of Vulnerability in Simple Terms
The Events Calendar for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify or delete event data they should not have access to. The vulnerability affects all versions up to 6.11.2.1. An attacker with a basic user account can bypass permission checks to alter event integrity or availability. Update to a version newer than 6.11.2.1 to remediate.
What an attacker can do
Modify or delete events without proper authorization.
Potential impact on your site
Event data can be corrupted or deleted by unauthorized users, disrupting event management and site reliability.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Subscriber or Contributor).
Key dates
External resources
Related vulnerabilities
