CVE-2026-2694: 
WordPress vulnerability analysis and mitigation

CVE-2026-2694 is an improper authorization vulnerability in The Events Calendar plugin for WordPress, allowing authenticated attackers with Contributor-level access or above to unauthorized modify or delete event-related data. It affects all versions of the plugin up to and including 6.15.16, developed by StellarWP. The vulnerability was published on February 25, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, ENISA EUVD).

The root cause is an improper capability check (CWE-285: Improper Authorization) in the can_edit and can_delete functions within the plugin's REST API endpoint handlers, specifically in Single_Event.php and Single_Venue.php. Because these functions do not adequately verify whether the requesting user has sufficient privileges, any authenticated user with Contributor-level access or higher can send crafted REST API requests to update or trash events, organizers, and venues. Exploitation requires only a valid WordPress account with at minimum Contributor role — no additional preconditions or complex attack chains are needed (Wordfence, WordPress Trac).

Successful exploitation allows authenticated attackers to modify or permanently trash events, organizers, and venues managed by the plugin via the REST API, resulting in unauthorized data modification (integrity impact) and potential data loss (availability impact). There is no confidentiality impact, as the vulnerability does not expose sensitive data. The primary risk is disruption to event management workflows and loss of published event content on affected WordPress sites (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running The Events Calendar plugin version 6.15.16 or earlier. This can be done by checking the plugin's readme.txt file (e.g., https://target.com/wp-content/plugins/the-events-calendar/readme.txt) or using tools like WPScan.
2. Obtain Contributor-level access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Authenticate and obtain a nonce/token: Log in and retrieve a valid WordPress REST API authentication token or nonce for the session.
4. Craft a malicious REST API request: Send an HTTP PUT or DELETE request to the plugin's REST API endpoint (e.g., /wp-json/tribe/events/v1/events/{id}) targeting an event, organizer, or venue not owned by the attacker.
5. Modify or trash target content: The insufficient can_edit/can_delete capability check allows the request to succeed, resulting in unauthorized modification or deletion of the targeted event data (Wordfence, WordPress Trac).

• Network: Unexpected REST API requests (HTTP PUT/DELETE) to /wp-json/tribe/events/v1/events/, /wp-json/tribe/events/v1/organizers/, or /wp-json/tribe/events/v1/venues/ endpoints from Contributor-level user accounts.
• Logs: WordPress access logs showing REST API calls to The Events Calendar endpoints by low-privileged users, particularly for resources they do not own; repeated modification or deletion requests in a short timeframe.
• Application: Unexplained changes to event, organizer, or venue records in the WordPress database (e.g., posts moved to trash or content altered without administrator action).

Site administrators should update The Events Calendar plugin to a version beyond 6.15.16, which includes the fix applied in changeset 3468694 on the WordPress plugin repository. The patch corrects the capability checks in the can_edit and can_delete functions to properly enforce authorization. As a temporary workaround, administrators can restrict Contributor-level user registration or disable REST API access for lower-privileged roles until the update is applied (Wordfence, WordPress Trac Changeset).