Events Manager CVE-2026-105068

Exploitation requires only that the Events Manager WordPress plugin be installed and active at version 7.4.5 or earlier and reachable over the network - no authentication (PR:N), no user interaction (UI:N), and no non-default configuration are indicated by the CVSS vector or description. The primary limiting factor is scope of impact rather than preconditions: only a LOW, confidentiality-bounded set of embedded sensitive data (C:L, I:N, A:N) is exposed, so there is no code execution or data modification. The description does not name the specific endpoint, feature, or data element involved, so defenders cannot scope the exposed field precisely from the available data.

This is a moderate, low-priority information-disclosure issue (CWE-201, Insertion of Sensitive Information Into Sent Data) rather than a critical threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw with only LOW confidentiality impact and no integrity or availability impact - consistent with limited sensitive data being embedded in server responses. No EPSS score was supplied, so exploitation probability cannot be quantified; the CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or weaponized code. No SSVC decision data was provided. The signals are internally consistent (network vector matches a WordPress plugin reachable over HTTP, and the LOW confidentiality-only impact matches a data-exposure weakness), so there is no conflict to flag. Bottom line: a genuine but low-severity exposure worth patching in routine cycles, not an emergency; the main residual uncertainty is exactly what sensitive data is leaked, which the description does not specify.

A remote, unauthenticated attacker sends crafted HTTP requests to a site running the Events Manager plugin (≤ 7.4.5) and receives responses that embed sensitive information the plugin should not disclose. No authentication or user interaction is required, but the impact is limited to reading a constrained set of exposed data. No public proof-of-concept exploit is referenced in the provided data.