Is CVE-2026-13390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13390 being exploited in the wild.

How severe is CVE-2026-13390?

Informational severity, with a CVSS score of 5.3, published 27 July 2026.

Which products and versions are affected?

The Events Calendar The Events Calendar < 6.16.5.1.

Is there a fix for CVE-2026-13390?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13390 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13390?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13390: The Events Calendar WordPress plugin auth bypass in Event Aggregator API

Q: Is there a fix for CVE-2026-13390?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-13390 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13390?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13390 · Severity: info · CVSS 5.3 · Published 2026-07-27

The Events Calendar, a popular WordPress plugin for managing event listings, contains a security flaw in its data import system. An unauthorized person can remotely interfere with active event imports, causing them to fail and injecting arbitrary text into internal logs. While this does not directly expose sensitive customer data, it can disrupt website operations and clutter administrative records with malicious content.

Quick answers

Is CVE-2026-13390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13390 being exploited in the wild.
How severe is CVE-2026-13390?: Informational severity, with a CVSS score of 5.3, published 27 July 2026.
Which products and versions are affected?: The Events Calendar The Events Calendar < 6.16.5.1.
Is there a fix for CVE-2026-13390?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13390 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13390?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Event Aggregator REST API route `tribe/event-aggregator/v1/import/<import_id>/state`. The plugin fails to perform an authorization check (CWE-862) and bypasses an integrity check (batch_hash validation) when the 'status' parameter is set to 'failed'. An unauthenticated attacker can send a crafted POST request to this endpoint to mark pending import records as failed. Additionally, the attacker can control the 'message' and 'message_slug' parameters, which are stored in the database as hidden comment records (`tribe-ea-error`). While the stored content is escaped in the admin interface (preventing XSS), the flaw allows for unauthorized data manipulation and denial of service for import tasks. The issue is fixed in version 6.16.5.1.

Affected products

The Events Calendar The Events Calendar < 6.16.5.1

Timeline

2026-07-06: disclosed: Publicly published by WPScan
2026-07-27: advisory: NVD publication date

References

https://wpscan.com/vulnerability/c7d3b1c5-3b3a-4359-aa41-0dfccb091fa4/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.