Is CVE-2026-84741 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-84741

Description

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.