Unauthenticated Shortcode Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-84740)

What Happened

A vulnerability was disclosed affecting The Events Calendar WordPress plugin. The flaw allows unauthenticated users to execute arbitrary shortcodes that are registered on the site. This is possible through an unauthenticated AJAX action that does not validate or sanitize submitted data before it is merged into the plugin's rendering context.

Technical Cause

The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as Injection). Specifically, data submitted to an unauthenticated AJAX action is not validated or sanitized before being merged into the plugin's rendering context. Because the AJAX action does not require authentication, an attacker with no account on the site can supply input that causes arbitrary shortcodes registered on the site to be executed.

Why It Matters

Shortcode injection can allow an attacker to trigger functionality exposed through any shortcode registered by the site, including those added by other plugins or themes, potentially leading to a range of downstream effects depending on what shortcodes are available. Because the vulnerability requires no authentication and no user interaction, it can be triggered directly by a remote attacker against any exposed, affected site.

Affected Versions

The Events Calendar plugin versions from 6.12.0 up to (but not including) 6.17.5.1 are affected.

Fixes and Mitigation

The fact package indicates that no fix is currently confirmed as available for this vulnerability (fix_available: false). Site owners should monitor the vendor's official plugin page and changelog for an update addressing CVE-2026-84740. Until a confirmed fix is released, consider restricting access to AJAX endpoints where feasible or using a web application firewall as a temporary compensating control.

Recommended Action

Site administrators running The Events Calendar plugin should verify their installed version against the affected range (6.12.0 up to, but not including, 6.17.5.1). Because no fix version is confirmed in the available data, check the plugin's official changelog directly for updates addressing this issue, and apply any available update as soon as it is released.