Vulnerability · Published Sep 24, 2026 · Assigned by WPScan
CVE-2026-93662Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
Medium 4.3
In plain English
A medium-severity information exposure in Events Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Events Manager | 7.4.1 – before 7.4.5 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/ exploit, vdb-entry, technical-description