# The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Missing Authorization to Event Publication via Ignored Events Restore Action

- **ID:** WPSEC-2026-2148
- **Plugin:** The Events Calendar (`the-events-calendar`), https://wordpress.org/plugins/the-events-calendar/
- **Affected versions:** all versions before 6.18.3
- **Fixed in:** 6.18.3 (Update to 6.18.3 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/the-events-calendar
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2148/

## Description

The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data via the Ignored Events bulk restore action in all versions up to, and including, 6.18.2, due to the restore_event() function not checking that the target event is actually in the Ignored status. When no previous status is stored, it restores the event as 'publish'. The 'tribe-restore' nonce for this action is not tied to an event, and any user who can view the Events list can obtain it while at least one imported event exists. This makes it possible for authenticated attackers, with contributor-level access and above, to publish their own draft or pending events without editorial review.

## References

- https://wpsec.com/vuln/WPSEC-2026-2148/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.3/
- https://wordpress.org/plugins/the-events-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2148/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.