The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes

The Events Calendar fails to perform proper per-object authorization checks on a family of REST API write routes. An authenticated user with a low-privilege role such as Contributor can modify, unpublish, trash, and take ownership of events, venues, and organizers belonging to other users, including administrators.

A successful exploitation allows an authenticated Contributor-level attacker to alter or remove event-related content owned by other users and potentially take ownership of those records. This breaks intended WordPress object-level access controls and can result in unauthorized modification, unpublishing, deletion, or ownership changes to Events, Venues, and Organizers.