The Events Calendar Missing Capability Check Vulnerability Allowing Unauthorized Access to Draft Event Information and QR Codes

A vulnerability exists in The Events Calendar plugin for WordPress, in all versions through 6.15.9. The issue arises from a missing capability check on the 'tec_qr_code_modal' AJAX endpoint, allowing authenticated users with Subscriber-level access and above to access draft event titles and generate or view QR codes for those events.

Impact

Exploitation of this vulnerability allows unauthorized access to draft event titles and the ability to generate and view QR codes for those events.

Remediation

Users are advised to update The Events Calendar plugin to version 6.15.10 or a newer patched version.