EUVD-2026-37841
GHSA-8968-x27c-fgxm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint, no complexity barrier, low confidentiality impact from partial private data disclosure; no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Event Koi Lite - Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the get_events. This makes it possible for unauthenticated attackers to extract sensitive data including virtual meeting URLs, physical location data, latitude/longitude coordinates, Google Maps links, and RSVP configuration belonging to draft, pending, and private events that are otherwise inaccessible via public URLs.
AnalysisAI
Unauthenticated sensitive information exposure in the Event Koi Lite WordPress plugin (all versions through 1.3.13.1) allows any remote visitor to retrieve private, draft, and pending event data via the unprotected get_events API endpoint. Exposed data includes virtual meeting URLs, physical venue addresses, GPS coordinates (latitude/longitude), Google Maps links, and RSVP configuration - all belonging to events deliberately kept out of public view. The root cause is CWE-862 (Missing Authorization): the get_events handler performs no publication-status or capability check before returning event records. No public exploit identified at time of analysis, but the endpoint is trivially callable by any unauthenticated HTTP client.
Technical ContextAI
The affected component is the Event Koi Lite plugin for WordPress, identified by CPE cpe:2.3:a:eventkoi:event_koi_lite_-_events_calendar,_event_management,_rsvp,_and_tickets:*:*:*:*:*:*:*:*. The vulnerability resides in three PHP source files: includes/core/class-events.php (around L270), includes/api/class-events.php (around L39 and L49), and includes/api/class-event.php (around L40 and L151), as referenced by the Wordfence Trac links. These files implement the plugin's event retrieval API, which is exposed either as a REST route or an internal AJAX handler. CWE-862 (Missing Authorization) describes the root cause: the code fetches and returns event objects regardless of their post_status (draft, pending, or private), bypassing WordPress's native capability and visibility model that would ordinarily gate access to unpublished content. The exposure of structured geolocation data (lat/long, Google Maps URLs) and virtual meeting links (likely video conferencing join URLs) represents the highest-sensitivity data classes returned.
RemediationAI
The primary remediation is to update the Event Koi Lite plugin to a version beyond 1.3.13.1. A fix commit is available in the plugin's SVN repository (changeset 3561415, referenced at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3561415%40eventkoi-lite&new=3561415%40eventkoi-lite); however, the exact released version number incorporating this fix is not independently confirmed from the available data - administrators should check the WordPress plugin directory for the current release and verify its changelog. If an immediate update is not possible, the most effective compensating control is to deactivate the plugin entirely until patching is complete, as the vulnerable endpoint is intrinsic to the plugin's functionality and cannot be disabled in isolation without modifying plugin code. Alternatively, a Web Application Firewall rule can block requests to the specific get_events API endpoint (the route pattern should be identified from the plugin's REST API registration), though this will break legitimate front-end event listing functionality. Restricting the WordPress REST API to authenticated users globally is a broader workaround but may break other plugins and themes that rely on public REST endpoints - weigh this trade-off carefully.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today