CVE-2026-13390

The Events Calendar WordPress plugin (affected: versions before 6.16.5.1) contains an unauthenticated security flaw in the Event Aggregator import REST API route. The vulnerability arises from missing authorization and an unchecked status value, enabling attackers to mark existing import records ...