The vulnerability in The Events Calendar plugin arises from an improper capability check within the can_edit and can_delete functions. Authenticated attackers possessing Contributor-level access or higher can use exposed REST API endpoints to update or trash events, organizers, and venues. This flaw effectively elevates the attacker’s privileges, allowing them to alter or delete content intended for higher‑privileged users. The weakness corresponds to CWE‑285, representing an authorization check failure that jeopardizes data integrity and availability.

WordPress sites running the The Events Calendar plugin by StellarWP with any version up to and including 6.15.16 are impacted. All editions that expose the REST API endpoints for single event, organizer, and venue objects are included.

The CVSS v3 score of 5.4 indicates medium severity, while an EPSS score of less than 1% shows a very low likelihood of active exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Exploitation requires legitimate credentials with Contributor or higher rights and access to the site’s REST API, typically through an authenticated AJAX request. Although the attack vector is limited to authenticated users, the potential for data loss or alteration makes it a concern for sites with active event management workflows.