The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Call or email us to get started.