Vulnerabilities / Events Manager / WPSEC-2026-0195
Events Manager <= 7.4.3 - Unauthenticated Sensitive Information Exposure via Password-Protected Events in REST API and iCal Feed
Medium 5.3
CWE-200Fixed in 7.4.4
- ID
- WPSEC-2026-0195
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.4
- Remediation
- Update to 7.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Events Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.3. The REST API read checks and the event and location list handlers only looked at published status and the private flag, and the iCal feeds did not exclude password-protected events. This makes it possible for unauthenticated attackers to read the raw content, name, description, location and other details of password-protected events and locations without knowing the password.
References
- https://wpsec.com/vuln/WPSEC-2026-0195/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.4/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS