[ CVE-2026-93662 · Published 24 Sep 2026 ]
Vulnerability in Unknown Events Manager
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.