What is the CVSS score of EUVD-2026-53727?

EUVD-2026-53727 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Events Manager are affected by EUVD-2026-53727?

Events Manager WordPress plugin before version 7.4 contains a flaw allowing unauthorized access to users' temporary file uploads; publicly available exploit code exists.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-53727?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53727. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-53727?

Within 24 hours, identify all WordPress installations running Events Manager and document their current versions. Within 7 days, update Events Manager to version 7.4 or later on all affected sites and verify successful completion. Within 30 days, audit server logs for suspicious API access patterns targeting upload endpoints and confirm no unauthorized data access occurred.

Events Manager EUVD-2026-53727

| CVE-2026-18050 HIGH

Information Exposure (CWE-200)

2026-08-06 WPScan

GHSA-g34q-c4r9-fwhj

WordPress Information Disclosure Events Manager

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AC:H reflects the genuine prerequisite of independently obtaining a high-entropy identifier that cannot be guessed; no integrity or availability impact applies per the vulnerability description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:22 vuln.today

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

AnalysisAI

Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain temporary upload identifier via secondary channel (HTTP interception or log leak)

Delivery

Send unauthenticated GET request to Events Manager REST file-serving route

Exploit

Bypass absent authorization check

Execution

Retrieve victim's in-progress uploaded file

Impact

Exfiltrate sensitive upload content

Access

Obtain temporary upload identifier via secondary channel (HTTP interception or log leak)

Delivery

Send unauthenticated GET request to Events Manager REST file-serving route

Exploit

Bypass absent authorization check

Execution

Retrieve victim's in-progress uploaded file

Impact

Exfiltrate sensitive upload content

Vulnerability AssessmentAI

Exploitation	The Events Manager WordPress plugin must be installed, active, and running a version prior to 7.4, with the file upload feature in use (i.e., at least one event registration form configured to accept file attachments). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 (High), but several signals materially challenge that as an accurate operational risk indicator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker operating on the same network segment as a victim - or with access to server-side request logs on an HTTP-only WordPress site - intercepts or recovers the high-entropy temporary identifier assigned when the victim begins uploading a document during event registration. The attacker then issues an unauthenticated HTTP GET request to the Events Manager REST endpoint referencing that identifier and receives the victim's in-progress file (which may contain sensitive personal, financial, or identity documents depending on the event's registration requirements) in the response body. …
Remediation	Update the Events Manager WordPress plugin to version 7.4 or later, which introduces the missing authorization check on the temporary file upload REST route; apply this update through the WordPress admin dashboard under Plugins or via WP-CLI (wp plugin update events-manager). … Detailed patch versions, workarounds, and compensating controls in full report.