EUVD-2026-53727
GHSA-g34q-c4r9-fwhj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the genuine prerequisite of independently obtaining a high-entropy identifier that cannot be guessed; no integrity or availability impact applies per the vulnerability description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.
AnalysisAI
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Events Manager WordPress plugin must be installed, active, and running a version prior to 7.4, with the file upload feature in use (i.e., at least one event registration form configured to accept file attachments). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 (High), but several signals materially challenge that as an accurate operational risk indicator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating on the same network segment as a victim - or with access to server-side request logs on an HTTP-only WordPress site - intercepts or recovers the high-entropy temporary identifier assigned when the victim begins uploading a document during event registration. The attacker then issues an unauthenticated HTTP GET request to the Events Manager REST endpoint referencing that identifier and receives the victim's in-progress file (which may contain sensitive personal, financial, or identity documents depending on the event's registration requirements) in the response body. … |
| Remediation | Update the Events Manager WordPress plugin to version 7.4 or later, which introduces the missing authorization check on the temporary file upload REST route; apply this update through the WordPress admin dashboard under Plugins or via WP-CLI (wp plugin update events-manager). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Events Manager and document their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Events Manager
View allThe Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injecti
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attac
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authe
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malici
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Go
PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.
Missing Authorization vulnerability in Pixelite Events Manager.4.6.4. Rated high severity (CVSS 8.8), this vulnerability
The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plu
The Events Manager - Calendar, Bookings, Tickets, and more!. Rated high severity (CVSS 7.5), this vulnerability is remot
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Ma
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today