The Events Calendar plugin for WordPress contains a missing capability check on the start_migration, cancel_migration, and revert_migration functions in all versions up to and including 6.15.13. This flaw allows an authenticated user with a subscriber role or higher to start, cancel, or revert a Custom Tables V1 database migration. The revert action can drop the custom database tables entirely, resulting in loss of event data. This represents an authorization issue (CWE‑862) that could compromise data integrity and availability for users who rely on the plugin's migration features.

StellarWP The Events Calendar plugin for WordPress versions 6.15.13 and earlier.

The vulnerability receives a CVSS score of 5.4, indicating a moderate risk, while the EPSS score is below 1%, suggesting the likelihood of exploitation is low. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated subscriber or higher, implying that the attack vector is limited to users with legitimate access to the WordPress site. If such a user abuses the missing authorization check, they can execute migration controls that may delete event data, but prevent broader compromise beyond the plugin's scope.