Quick Event Manager EUVD-2026-114589

Exploitation requires only that a target site run Quick Event Manager in the 8.4.6-9.18 range with the calendar export functionality reachable, which is the default behavior - no authentication, user interaction, or non-default configuration is needed (consistent with PR:N/UI:N). What limits real-world impact is the nature of what is exposed: the flaw returns only the content of draft and private posts (CWE-200, C:L), not credentials, database contents, or write access, and it has no integrity or availability effect. Practical value to an attacker therefore depends on the target actually having sensitive unpublished event posts.

Signals are consistent and point to a genuine-but-modest issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N, base 5.3 Medium) describes remote, unauthenticated, low-complexity access with only low confidentiality impact and no integrity or availability effect - matching the description of unauthenticated disclosure of draft/private post content via the calendar export. EPSS is low at 0.16% (5th percentile), and SSVC records Exploitation: none, so there is no indication of active exploitation; it is NOT in CISA KEV. The one tension worth noting is that SSVC marks Automatable: yes (the export endpoint can be scripted at scale) while EPSS remains low - this reflects that the flaw is easy to automate but there is currently no observed real-world exploitation, i.e. opportunity without evidence of use. The vendor priority label is this_month, consistent with a low-severity information-disclosure bug that should be patched on a normal cadence rather than treated as an incident. Net: a real, confirmed information-disclosure vulnerability of limited impact, not a high-urgency threat.

An unauthenticated attacker requests the plugin's calendar export function on a site running Quick Event Manager between 8.4.6 and 9.18; because the export does not check post status or type, the response returns details of posts that are still in draft or marked private. This leaks unpublished or restricted content (e.g. upcoming announcements or internal event details) to anyone, with no login required. No public exploit code is identified at time of analysis, though the export endpoint is straightforward to script.