Security Alert Summary
The Events Manager WordPress plugin before 7.4.5 contains an information exposure vulnerability that can allow a low-privileged authenticated user to read other accounts unpublished, pending, or trashed event and venue content, including full street addresses. Site owners should review affected instances and follow recommended mitigation steps.
CVE Details
- CVE ID: CVE-2026-93662
- Affected component: Events Manager WordPress plugin
- Affected versions: Versions before 7.4.5 (the advisory lists 7.4.1 as an example of an affected version)
- Published: September 24, 2026 at 6:17:04 AM UTC
- Last modified: September 24, 2026 at 2:42:02 PM UTC
- CVSS v3.1: Base Score 4.3, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Authentication / Privileges / User interaction: Requires authentication as a low-privileged user (Privileges Required: LOW). No user interaction is required (UI: NONE).
- Primary impact: Confidentiality: LOW (information exposure); Integrity: NONE; Availability: NONE
- Weakness: CWE-200 (Information Exposure)
Technical Details
The plugin fails to enforce the expected scope of its logged-in event and location search when a caller supplies their own owner value. As described, this allows a low-privileged authenticated user to bypass owner scoping and retrieve event and venue records that belong to other accounts. The exposed content can include unpublished, pending, or trashed entries and may contain sensitive fields such as full street addresses.
No specific function names or REST endpoints are named in the provided advisory. The root cause described is a missing or insufficient server-side scope enforcement when owner values are accepted from caller-supplied input.
The impact is limited to information disclosure of event and venue data accessible via the vulnerable search path. The issue does not indicate modification or deletion of data, or service disruption, based on the provided information.
How This Could Impact Your Website
On a site with multiple users, a low-privileged account such as a contributor or external contractor could use the vulnerable search behavior to view unpublished or trashed events and venue records created by other staff. For example, an external contributor might retrieve venue street addresses or draft event details they are not meant to see. This type of exposure can increase the risk of targeted phishing or social engineering against staff or partners and may reveal operational information about upcoming events or private locations. It could also expose internal contact details if those are stored in event or venue records.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. Note that versions before 7.4.5 are identified as affected in the advisory.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privileged accounts.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unauthorized access attempts.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
