# Events Calendar for FooEvents <= 2.0.5 - Authenticated (Contributor+) Missing Authorization to Eventbrite Event Sync via Event Meta Save

- **ID:** WPSEC-2026-2249
- **Plugin:** Events Calendar by FooEvents (`fooevents-calendar`), https://wordpress.org/plugins/fooevents-calendar/
- **Affected versions:** all versions before 2.0.6
- **Fixed in:** 2.0.6 (Update to 2.0.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fooevents-calendar
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2249/

## Description

The Events Calendar by FooEvents plugin for WordPress is vulnerable to unauthorized actions in all versions up to, and including, 2.0.5 due to missing calendar capability checks in the handlers that save event meta and synchronize events to Eventbrite when a post is saved. This makes it possible for authenticated attackers, with Contributor-level access and above, to save event details and push events to the site's connected Eventbrite account using the site's stored Eventbrite token, an action intended to be limited to users permitted to manage calendar events.

## References

- https://wpsec.com/vuln/WPSEC-2026-2249/
- https://plugins.svn.wordpress.org/fooevents-calendar/tags/2.0.6/
- https://wordpress.org/plugins/fooevents-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2249/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.