Events Manager EUVD-2026-85809

Requires an authenticated low-privileged WordPress account on a site running Events Manager 7.4.1-7.4.4 (PR:L); no admin rights and no user interaction are needed. Exploitation is triggered by invoking the logged-in event or location search and supplying an attacker-chosen 'owner' value, which the plugin fails to constrain to the caller. The limiting factors are: (1) an account on the target site is mandatory - it is not unauthenticated; (2) impact is read-only disclosure of non-public event/venue content (unpublished, pending, trashed items and street addresses), with no write or availability effect; (3) sites where such content or multiple content owners do not exist have little to expose.

This is a genuine but low-to-moderate priority issue, well-characterized as a MEDIUM. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) describes a network-reachable, low-complexity broken-authorization (IDOR) flaw that requires an authenticated low-privileged account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. Multiple signals converge on 'real but not urgent': SSVC scores Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=partial - consistent with the low CVSS. There is no EPSS score and no CISA KEV listing provided, so there is no evidence of active or widespread exploitation. However, a public exploit reference exists (WPScan) and a patch is available, which raises practical opportunistic risk for unpatched multi-user sites. The signals are internally consistent - no CVSS-vs-description conflict here (the description clearly matches a network, low-priv, read-only authorization bypass). The main real-world caveat is scope of impact: 'C:L' understates the sensitivity for some deployments because leaked data includes full street addresses of venues/organizers, a privacy concern beyond the raw score. Net: patch in normal cycle; not an emergency.

An attacker registers or already holds a low-privileged account (e.g., subscriber/contributor level) on a WordPress site running Events Manager and issues a logged-in event or location search request supplying an arbitrary 'owner' value. Because the plugin fails to force the query scope to the caller's own account, it returns other users' unpublished, pending, or trashed events and venues - including full street addresses. A public exploit reference is documented by WPScan, and the low attack complexity (AC:L) makes reproduction trivial.