Is CVE-2026-84741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84741 being exploited in the wild.

How severe is CVE-2026-84741?

Medium severity, with a CVSS score of 5.3, published 23 September 2026.

Which products and versions are affected?

Modern Tribe The Events Calendar 4.5 to 6.17.4.1.

Is there a fix for CVE-2026-84741?

A patch was published on 2026-09-23: version 6.17.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84741 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84741?

Check whether you run Modern Tribe The Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84741: The Events Calendar REST API information disclosure

CVE-2026-84741 · Severity: medium · CVSS 5.3 · Published 2026-09-23

The Events Calendar WordPress plugin improperly exposes unpublished venue and organizer records through its REST API without checking access permissions. An attacker can read the full details of records that site administrators never intended to publish, potentially exposing sensitive business or contact information. The vulnerability affects all unauthenticated users and requires no special setup or interaction.

Vendors: Modern Tribe.

Quick answers

Is CVE-2026-84741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84741 being exploited in the wild.
How severe is CVE-2026-84741?: Medium severity, with a CVSS score of 5.3, published 23 September 2026.
Which products and versions are affected?: Modern Tribe The Events Calendar 4.5 to 6.17.4.1.
Is there a fix for CVE-2026-84741?: A patch was published on 2026-09-23: version 6.17.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84741 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84741?: Check whether you run Modern Tribe The Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to validate the post status of linked venue and organizer records before including them in REST API responses, violating the principle of least privilege for API access. This is a Sensitive Data Exposure vulnerability (CWE-200) accessible over the network to unauthenticated attackers with no preconditions. Version 6.17.5 patches the issue by implementing post status checks.

Affected products

Modern Tribe The Events Calendar 4.5 to 6.17.4.1

Timeline

2026-09-21: disclosed
2026-09-23: patched: version 6.17.5

References

https://wpscan.com/vulnerability/0f34a90e-3d8b-4a87-a2ed-fe4d2c481732/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.