Events Manager EUVD-2026-53727

The Events Manager WordPress plugin must be installed, active, and running a version prior to 7.4, with the file upload feature in use (i.e., at least one event registration form configured to accept file attachments). The WordPress REST API must be reachable - this is the default on all public WordPress installations and is not a restrictive prerequisite. Critically, the attacker must independently possess the specific high-entropy temporary upload identifier for a target user's in-progress upload; the description explicitly confirms this identifier cannot be obtained by guessing alone and is disclosed only to the uploader. The target file must still reside in temporary storage - it is purged on form submission or by scheduled cron cleanup, so the exploitation window is bounded and time-limited. Authentication is not required (CVSS PR:N confirmed). Exploitation is therefore practically limited to scenarios where the identifier has leaked through a secondary channel - such as unencrypted HTTP traffic (no TLS), server-side access or debug log exposure, or a compromised browser session belonging to the uploader - and the cleanup window has not elapsed.

The NVD CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 (High), but several signals materially challenge that as an accurate operational risk indicator. AC:L treats the attack as low-complexity once preconditions are met, yet the description explicitly states cross-user access 'is not achievable by guessing alone,' acknowledging that identifier acquisition is a real prerequisite barrier AC:L does not capture. EPSS at 0.14% (4th percentile) corroborates very low exploitation probability in the wild, consistent with the identifier barrier. The SSVC classification of Automatable:yes and Technical Impact:partial is mechanically accurate - a known identifier enables a fully automated unauthenticated HTTP fetch - but automation of identifier acquisition itself remains the practical blocking constraint. No CISA KEV listing exists, confirming no observed active exploitation at time of analysis. The confirmed public POC raises risk above theoretical and warrants prompt patching, but the combination of high-entropy identifiers, an ephemeral file existence window, and the necessity for a secondary disclosure channel (unencrypted HTTP interception, server log leak, compromised session) means real-world impact is substantially lower than the raw CVSS score implies. This is a genuine but non-emergency patch priority.

An attacker operating on the same network segment as a victim - or with access to server-side request logs on an HTTP-only WordPress site - intercepts or recovers the high-entropy temporary identifier assigned when the victim begins uploading a document during event registration. The attacker then issues an unauthenticated HTTP GET request to the Events Manager REST endpoint referencing that identifier and receives the victim's in-progress file (which may contain sensitive personal, financial, or identity documents depending on the event's registration requirements) in the response body. A public POC demonstrating this exact request pattern is available via WPScan.