5.4
MediumCVSS 3.1 · from Patchstack
CVE-2026-119367
WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability
the-events-calendar · Missing authorization · CWE-862Affectedthe-events-calendar
FixUpdate to 6.18.3 or newer
PublishedOct 30, 16:10 · Patchstack
ScoredOct 30 · 5.4 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
From Patchstack
Affected and fixed versions
ProductAffectedFixed inthe-events-calendarearlier versions6.18.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known