Missing Capability Check in The Events Calendar System Information Opt-in

The system information opt-in handler verified a nonce but never checked the caller’s capability, so any logged-in user who could obtain the nonce could toggle the setting. The handler now also requires manage_options.

This vulnerability affects the following application versions:

• The Events Calendar 4.6.10
• The Events Calendar 4.6.10.2
• The Events Calendar 4.6.11
• The Events Calendar 4.6.11.2
• The Events Calendar 4.6.12.1
• The Events Calendar 4.6.13.1
• The Events Calendar 4.6.14
• The Events Calendar 4.6.14.2
• The Events Calendar 4.6.15.1
• The Events Calendar 4.6.16.1
• The Events Calendar 4.6.17.1
• The Events Calendar 4.6.18.1
• The Events Calendar 4.6.19.1
• The Events Calendar 4.6.20
• The Events Calendar 4.6.20.2
• The Events Calendar 4.6.21.1
• The Events Calendar 4.6.22
• The Events Calendar 4.6.22.2
• The Events Calendar 4.6.23.1
• The Events Calendar 4.6.24
• The Events Calendar 4.6.24.2
• The Events Calendar 4.6.25.1
• The Events Calendar 4.6.26
• The Events Calendar 4.6.26.2
• The Events Calendar 4.7
• The Events Calendar 4.7.0.2
• The Events Calendar 4.7.1.1
• The Events Calendar 4.7.2.1
• The Events Calendar 4.7.3.1
• The Events Calendar 4.7.4.1
• The Events Calendar 4.8
• The Events Calendar 4.8.0.2
• The Events Calendar 4.8.1.1
• The Events Calendar 4.8.2.1
• The Events Calendar 4.9.0.1
• The Events Calendar 4.9.0.2
• The Events Calendar 4.9.0.4
• The Events Calendar 4.9.1
• The Events Calendar 4.9.1.2
• The Events Calendar 4.9.2.1
• The Events Calendar 4.9.3
• The Events Calendar 4.9.3.1
• The Events Calendar 4.9.3.3
• The Events Calendar 4.9.4.1
• The Events Calendar 4.9.6.1
• The Events Calendar 4.9.7.1
• The Events Calendar 4.9.8.1
• The Events Calendar 4.9.9.1
• The Events Calendar 4.9.10.1
• The Events Calendar 4.9.11.1
• The Events Calendar 4.9.12.1
• The Events Calendar 4.9.13.1
• The Events Calendar 4.9.14.1
• The Events Calendar 5.0.0
• The Events Calendar 5.0.0.1
• The Events Calendar 5.0.0.3
• The Events Calendar 5.0.1.1
• The Events Calendar 5.0.1.2
• The Events Calendar 5.0.2
• The Events Calendar 5.0.2.2
• The Events Calendar 5.0.2.3
• The Events Calendar 5.0.3
• The Events Calendar 5.0.3.3
• The Events Calendar 5.1.0.1
• The Events Calendar 5.1.0.2
• The Events Calendar 5.1.1.1
• The Events Calendar 5.1.1.2
• The Events Calendar 5.1.2.1
• The Events Calendar 5.1.2.2
• The Events Calendar 5.1.3
• The Events Calendar 5.1.3.1
• The Events Calendar 5.1.4
• The Events Calendar 5.1.4.1
• The Events Calendar 5.1.5
• The Events Calendar 5.1.5.1
• The Events Calendar 5.1.6
• The Events Calendar 5.1.6.1
• The Events Calendar 5.2.0
• The Events Calendar 5.2.0.1
• The Events Calendar 5.2.1
• The Events Calendar 5.2.1.1
• The Events Calendar 5.2.1.2
• The Events Calendar 5.3.0
• The Events Calendar 5.3.0.1
• The Events Calendar 5.3.1
• The Events Calendar 5.3.1.1
• The Events Calendar 5.3.1.2
• The Events Calendar 5.3.2
• The Events Calendar 5.3.2.1
• The Events Calendar 5.3.2.2
• The Events Calendar 5.4.0
• The Events Calendar 5.4.0.1
• The Events Calendar 5.4.0.2
• The Events Calendar 5.4.0.3
• The Events Calendar 5.5.0
• The Events Calendar 5.5.0.1
• The Events Calendar 5.5.0.2
• The Events Calendar 5.6.0
• The Events Calendar 5.7.0
• The Events Calendar 5.7.1
• The Events Calendar 5.8.0
• The Events Calendar 5.8.1
• The Events Calendar 5.8.2
• The Events Calendar 5.9.0
• The Events Calendar 5.9.1
• The Events Calendar 5.9.2
• The Events Calendar 5.10.0
• The Events Calendar 5.10.1
• The Events Calendar 5.11.0
• The Events Calendar 5.12.0
• The Events Calendar 5.12.1
• The Events Calendar 5.12.2
• The Events Calendar 5.12.3
• The Events Calendar 5.12.4
• The Events Calendar 5.13.0
• The Events Calendar 5.14.0
• The Events Calendar 5.14.0.1
• The Events Calendar 5.14.0.2
• The Events Calendar 5.14.0.3
• The Events Calendar 5.14.0.4
• The Events Calendar 5.14.1
• The Events Calendar 5.14.2
• The Events Calendar 5.14.2.1
• The Events Calendar 5.15.0
• The Events Calendar 5.15.0.1
• The Events Calendar 5.16.0
• The Events Calendar 5.16.1
• The Events Calendar 5.16.1.1
• The Events Calendar 5.16.2
• The Events Calendar 5.16.2.1
• The Events Calendar 5.16.3
• The Events Calendar 5.16.3.1
• The Events Calendar 5.16.4
• The Events Calendar 5.16.4.1
• The Events Calendar 6.0.0
• The Events Calendar 6.0.0.1
• The Events Calendar 6.0.1
• The Events Calendar 6.0.1.1
• The Events Calendar 6.0.2
• The Events Calendar 6.0.3
• The Events Calendar 6.0.3.1
• The Events Calendar 6.0.4
• The Events Calendar 6.0.5
• The Events Calendar 6.0.6
• The Events Calendar 6.0.6.1
• The Events Calendar 6.0.6.2
• The Events Calendar 6.0.7
• The Events Calendar 6.0.7.1
• The Events Calendar 6.0.8
• The Events Calendar 6.0.9
• The Events Calendar 6.0.10
• The Events Calendar 6.0.11
• The Events Calendar 6.0.12
• The Events Calendar 6.0.13
• The Events Calendar 6.0.13.1
• The Events Calendar 6.1.0
• The Events Calendar 6.1.0.1
• The Events Calendar 6.1.0.2
• The Events Calendar 6.1.1
• The Events Calendar 6.1.2
• The Events Calendar 6.1.2.1
• The Events Calendar 6.1.2.2
• The Events Calendar 6.1.3
• The Events Calendar 6.1.4
• The Events Calendar 6.2.0
• The Events Calendar 6.2.0.1
• The Events Calendar 6.2.1
• The Events Calendar 6.2.2
• The Events Calendar 6.2.2.1
• The Events Calendar 6.2.3
• The Events Calendar 6.2.3.1
• The Events Calendar 6.2.3.2
• The Events Calendar 6.2.4
• The Events Calendar 6.2.5
• The Events Calendar 6.2.6
• The Events Calendar 6.2.6.1
• The Events Calendar 6.2.7
• The Events Calendar 6.2.8
• The Events Calendar 6.2.8.1
• The Events Calendar 6.2.8.2
• The Events Calendar 6.2.9
• The Events Calendar 6.3.0
• The Events Calendar 6.3.1
• The Events Calendar 6.3.2
• The Events Calendar 6.3.3
• The Events Calendar 6.3.3.1
• The Events Calendar 6.3.4
• The Events Calendar 6.3.5
• The Events Calendar 6.3.6
• The Events Calendar 6.3.7
• The Events Calendar 6.4.0
• The Events Calendar 6.4.0.1
• The Events Calendar 6.5.0
• The Events Calendar 6.5.0.1
• The Events Calendar 6.5.1
• The Events Calendar 6.5.1.1
• The Events Calendar 6.5.1.2
• The Events Calendar 6.5.1.3
• The Events Calendar 6.5.1.4
• The Events Calendar 6.5.1.5
• The Events Calendar 6.5.1.6
• The Events Calendar 6.5.2
• The Events Calendar 6.6.0
• The Events Calendar 6.6.0.1
• The Events Calendar 6.6.0.2
• The Events Calendar 6.6.1
• The Events Calendar 6.6.2
• The Events Calendar 6.6.3
• The Events Calendar 6.6.4
• The Events Calendar 6.6.4.1
• The Events Calendar 6.6.4.2
• The Events Calendar 6.7.0
• The Events Calendar 6.7.1
• The Events Calendar 6.8.0
• The Events Calendar 6.8.1
• The Events Calendar 6.8.2
• The Events Calendar 6.8.2.1
• The Events Calendar 6.8.3
• The Events Calendar 6.9.0
• The Events Calendar 6.9.1
• The Events Calendar 6.10.0
• The Events Calendar 6.10.1
• The Events Calendar 6.10.1.1
• The Events Calendar 6.10.2
• The Events Calendar 6.10.3
• The Events Calendar 6.11.0
• The Events Calendar 6.11.0.1
• The Events Calendar 6.11.1
• The Events Calendar 6.11.2
• The Events Calendar 6.11.2.1
• The Events Calendar 6.13.0
• The Events Calendar 6.13.1
• The Events Calendar 6.13.2.1
• The Events Calendar 6.14.0
• The Events Calendar 6.14.1
• The Events Calendar 6.14.2
• The Events Calendar 6.15.0
• The Events Calendar 6.15.0.1
• The Events Calendar 6.15.1
• The Events Calendar 6.15.1.1
• The Events Calendar 6.15.2
• The Events Calendar 6.15.3
• The Events Calendar 6.15.4
• The Events Calendar 6.15.5
• The Events Calendar 6.15.6
• The Events Calendar 6.15.7
• The Events Calendar 6.15.8
• The Events Calendar 6.15.9
• The Events Calendar 6.15.10
• The Events Calendar 6.15.11
• The Events Calendar 6.15.12
• The Events Calendar 6.15.12.1
• The Events Calendar 6.15.12.2