The Events Calendar plugin for WordPress allows authenticated users with Subscriber-level access and above to access the tec_qr_code_modal AJAX endpoint without performing a capability check. This flaw enables the viewing of draft event names and the generation or viewing of QR codes for those drafts, exposing sensitive event details. The impact is a confidentiality breach of unpublished event information, but it does not provide code execution or data modification capabilities.

All versions of the Events Calendar plugin by StellarWP up to and including 6.15.9 are affected. Any WordPress installation that uses a vulnerable version of this plugin is at risk of exposing unpublished event data to authenticated users.

The CVSS score of 4.3 classifies the vulnerability as medium severity. The EPSS score of less than 1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need a valid WordPress account with at least Subscriber role to send requests to the tec_qr_code_modal endpoint and read the returned data. No additional privileges or network access are required beyond the normal authentication process.