The Events Calendar WordPress plugin prior to 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
tri the events calendar