{
 "id": "WPSEC-2026-0970",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0970/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0970/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0970/index.md",
 "title": "The Events Calendar <= 6.18.0 - Unauthenticated Denial of Service via 'posts_per_page' Parameter",
 "description": "The The Events Calendar plugin for WordPress is vulnerable to Denial of Service via the 'posts_per_page' request parameter in all versions up to, and including, 6.18.0. This is due to the Views v2 calendar views (such as the List view) reading the number of events per page from the request with no upper limit and using it directly as the size of the event query. This makes it possible for unauthenticated attackers to make public calendar pages fetch and render an arbitrarily large number of events in a single request, which uses up server resources and can slow the site down.",
 "plugin": {
  "slug": "the-events-calendar",
  "name": "The Events Calendar",
  "full_name": "The Events Calendar",
  "wordpress_org": "https://wordpress.org/plugins/the-events-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/the-events-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/the-events-calendar"
 },
 "type": "DOS",
 "cwe": [
  "CWE-770"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.18.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.18.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.18.1",
 "remediation": "Update to 6.18.1 or later.",
 "fix_released": "2026-10-13T20:16:15+00:00",
 "published": "2026-10-14T20:43:57+00:00",
 "updated": "2026-10-14T19:49:55.026438+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0970/",
  "https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.1/",
  "https://wordpress.org/plugins/the-events-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/the-events-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-14"
 }
}