The vulnerability exists in the Event Aggregator import REST API of the WordPress Events Calendar plugin when it is older than 6.16.5.1. The API route that is used to import external calendars fails to perform an authorization check and an integrity check for the import status field. An attacker who can reach the endpoint without authentication can set the status of any existing import record to "failed" and can store arbitrary data in a hidden comment associated with that record. This allows the attacker to tamper with import metadata, obscure legitimate data, and potentially inject covert content that is not visible to normal users, which can compromise the integrity of the calendar data. The weakness is classified as CWE‑862 (Authorization Bypass via Privilege Escalation).

Any WordPress site that installs The Events Calendar plugin with a version earlier than 6.16.5.1 is affected. No specific sub‑versions are listed, so all legacy releases are presumed vulnerable until the plugin is updated to 6.16.5.1 or later.

The CVSS score of 5.3 indicates moderate severity, primarily due to the required network attack vector and lack of confidentiality impact. The EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation campaigns. However, attackers could exploit the unauthenticated REST endpoint by sending crafted HTTP requests from any host, bypassing authentication and altering import status or hidden comments. No exploit code is publicly documented, but the attack scenario is straightforward for an unauthenticated attacker who identifies and uses the affected route.