Vulnerabilities / The Events Calendar / WPSEC-2026-0970
The Events Calendar <= 6.18.0 - Unauthenticated Denial of Service via 'posts_per_page' Parameter
Medium 5.3
CWE-770Fixed in 6.18.1
- ID
- WPSEC-2026-0970
- Plugin
- The Events Calendar (the-events-calendar)
- Affected
- all versions before 6.18.1
- Remediation
- Update to 6.18.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-770
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-14
- Attack surface
- The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The The Events Calendar plugin for WordPress is vulnerable to Denial of Service via the 'posts_per_page' request parameter in all versions up to, and including, 6.18.0. This is due to the Views v2 calendar views (such as the List view) reading the number of events per page from the request with no upper limit and using it directly as the size of the event query. This makes it possible for unauthenticated attackers to make public calendar pages fetch and render an arbitrarily large number of events in a single request, which uses up server resources and can slow the site down.
References
- https://wpsec.com/vuln/WPSEC-2026-0970/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.1/
- https://wordpress.org/plugins/the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS