Vulnerabilities / Events Calendar for FooEvents / WPSEC-2026-2249
Events Calendar for FooEvents <= 2.0.5 - Authenticated (Contributor+) Missing Authorization to Eventbrite Event Sync via Event Meta Save
Medium 4.3
CWE-862Fixed in 2.0.6
- ID
- WPSEC-2026-2249
- Plugin
- Events Calendar by FooEvents (fooevents-calendar)
- Affected
- all versions before 2.0.6
- Remediation
- Update to 2.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Events Calendar for FooEvents on WPSec AttackSurface
- Fix released
- Published
Description
The Events Calendar by FooEvents plugin for WordPress is vulnerable to unauthorized actions in all versions up to, and including, 2.0.5 due to missing calendar capability checks in the handlers that save event meta and synchronize events to Eventbrite when a post is saved. This makes it possible for authenticated attackers, with Contributor-level access and above, to save event details and push events to the site's connected Eventbrite account using the site's stored Eventbrite token, an action intended to be limited to users permitted to manage calendar events.
References
- https://wpsec.com/vuln/WPSEC-2026-2249/
- https://plugins.svn.wordpress.org/fooevents-calendar/tags/2.0.6/
- https://wordpress.org/plugins/fooevents-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS