CVE-2024-1295: The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-14 · updated 2026-06-17

Description

The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)

Affected products

Tri The Events Calendar: before 6.4.0.1 — fixed in 6.4.0.1

How to fix

Upgrade to a fixed version: Tri The Events Calendar 6.4.0.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/3cffbeb0-545a-4002-b02c-0fa38cada1db/
https://wpscan.com/vulnerability/3cffbeb0-545a-4002-b02c-0fa38cada1db/

Get alerted when CVE-2024-1295 or the next vulnerability affects your stack