The Events Calendar WordPress plugin fails to enforce the required capability before creating or updating content via its REST API. This oversight allows users with a role that cannot normally publish, such as contributor, to publish posts directly, bypassing editorial review. The underlying weakness is an improper access control (CWE-863) that permits privilege escalation within the content management flow.

The vulnerability applies to version ranges of the Events Calendar plugin from 6.15.0 up to and including 6.17.4.1. All instances of the plugin before the 6.17.5 release are affected regardless of the WordPress installation or configuration. The issue is limited to the plugin's REST API v1 endpoints handling content creation and updates.

The CVSS score of 2.7 indicates a low severity rating, and there is no EPSS score available. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is accessed through the REST API, an attacker must first be authenticated to the site with a role such as contributor. Once authenticated, the attacker can exploit the exposed endpoints to create or update posts that are published immediately, potentially compromising editorial workflows. No additional conditions or privilege escalation beyond the role are required.