# The Events Calendar <= 6.18.0 - Unauthenticated Denial of Service via 'posts_per_page' Parameter

- **ID:** WPSEC-2026-0970
- **Plugin:** The Events Calendar (`the-events-calendar`), https://wordpress.org/plugins/the-events-calendar/
- **Affected versions:** all versions before 6.18.1
- **Fixed in:** 6.18.1 (Update to 6.18.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-770
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/the-events-calendar
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0970/

## Description

The The Events Calendar plugin for WordPress is vulnerable to Denial of Service via the 'posts_per_page' request parameter in all versions up to, and including, 6.18.0. This is due to the Views v2 calendar views (such as the List view) reading the number of events per page from the request with no upper limit and using it directly as the size of the event query. This makes it possible for unauthenticated attackers to make public calendar pages fetch and render an arbitrarily large number of events in a single request, which uses up server resources and can slow the site down.

## References

- https://wpsec.com/vuln/WPSEC-2026-0970/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.1/
- https://wordpress.org/plugins/the-events-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0970/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.