{
 "id": "WPSEC-2026-2249",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2249/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2249/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2249/index.md",
 "title": "Events Calendar for FooEvents <= 2.0.5 - Authenticated (Contributor+) Missing Authorization to Eventbrite Event Sync via Event Meta Save",
 "description": "The Events Calendar by FooEvents plugin for WordPress is vulnerable to unauthorized actions in all versions up to, and including, 2.0.5 due to missing calendar capability checks in the handlers that save event meta and synchronize events to Eventbrite when a post is saved. This makes it possible for authenticated attackers, with Contributor-level access and above, to save event details and push events to the site's connected Eventbrite account using the site's stored Eventbrite token, an action intended to be limited to users permitted to manage calendar events.",
 "plugin": {
  "slug": "fooevents-calendar",
  "name": "Events Calendar for FooEvents",
  "full_name": "Events Calendar by FooEvents",
  "wordpress_org": "https://wordpress.org/plugins/fooevents-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fooevents-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fooevents-calendar"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.6",
 "remediation": "Update to 2.0.6 or later.",
 "fix_released": "2026-11-02T13:03:19+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:21:32.917022+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2249/",
  "https://plugins.svn.wordpress.org/fooevents-calendar/tags/2.0.6/",
  "https://wordpress.org/plugins/fooevents-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fooevents-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}