Read the docs
TI-2024-01205 Aliases CVE-2024-1295GHSA-66gp-w3xm-x3cc

The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access

Priority MEDIUM 62Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00464 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed events-calendar-pro (Unknown): 6.4.0.1The Events Calendar (Unknown): 6.4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unknownevents-calendar-probefore 6.4.0.16.4.0.1Patch availableCNA
UnknownThe Events Calendarbefore 6.4.0.16.4.0.1Patch availableCNA
  • events-calendar-pro VendorUnknown Affected before 6.4.0.1 Fixed in 6.4.0.1 Patch available CNA
  • The Events Calendar VendorUnknown Affected before 6.4.0.1 Fixed in 6.4.0.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:tri:the_events_calendar:*:*:*:*:*:wordpress:*:*before 6.4.0.1VulnerableTri
cpe:2.3:a:tri:the_events_calendar:*:*:pro:*:*:wordpress:*:*before 6.4.0.1VulnerableTri
  • cpe:2.3:a:tri:the_events_calendar:*:*:*:*:*:wordpress:*:* Versions before 6.4.0.1 Vulnerable ·Tri
  • cpe:2.3:a:tri:the_events_calendar:*:*:pro:*:*:wordpress:*:* Versions before 6.4.0.1 Vulnerable ·Tri

Remediation

  • Fix · CNA events-calendar-pro (Unknown) Fixed in 6.4.0.1
  • Fix · CNA The Events Calendar (Unknown) Fixed in 6.4.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1295
  2. 2026-10-03 Alias added: GHSA-66gp-w3xm-x3cc

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences