CVE-2026-93662 in Events Manager Plugin
Summary
by MITRE • 09/24/2026
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Events Manager for WordPress prior to version 7.4.5 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw arises from the plugin's handling of user-supplied input during search operations related to events and locations. When an authenticated user initiates a query to list or retrieve details about events or venues, the application logic fails to enforce strict scope boundaries based on the currently logged-in user's identity. Instead, if the caller provides their own owner value within the request parameters, the system does not validate whether this supplied identifier matches the actual permissions and ownership associated with the authenticated session. This lack of server-side validation allows an attacker to manipulate the query context effectively bypassing intended restrictions.
From a technical perspective, the core issue lies in the absence of robust object-level permission checks during data retrieval operations. In secure software design, any request that accesses or modifies resources must verify that the requesting entity has explicit authorization for those specific objects. Here, the application trusts user-supplied input regarding ownership without cross-referencing it against the database records associated with the active session. This oversight enables a low-privileged user to craft requests that return data belonging to other accounts. The attacker can specify owner identifiers corresponding to administrators or other users, thereby tricking the backend into returning content they are not authorized to view.
The operational impact of this vulnerability is significant due to the sensitive nature of the exposed data. Attackers with low-privileged access levels, such as subscribers or contributors who typically have limited capabilities within a WordPress installation, can exploit this flaw to read unpublished events, pending approvals, and trashed venues belonging to other users. This includes highly sensitive information such as full street addresses associated with these locations. The exposure of unpublished content poses a risk of intellectual property theft or competitive intelligence gathering, while the disclosure of physical addresses compromises personal privacy and potentially safety for venue owners who may not intend for their location details to be public until an event is officially published.
This vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it relies on legitimate authentication credentials to gain unauthorized access to specific data objects rather than exploiting a system-level privilege escalation. It also reflects aspects of CWE-639 Authorization Bypass Through User-Controlled Key, where the attacker controls the key used for authorization decisions without proper validation. The ability to view trashed content is particularly concerning as it suggests that soft deletes are not effectively isolating data from unauthorized viewers, indicating a deeper architectural flaw in how resource lifecycle states are managed and secured.
To mitigate this vulnerability, administrators must upgrade the Events Manager plugin to version 7.4.5 or later, where these access control checks have been corrected. In addition to updating software, it is advisable to implement principle of least privilege across all user roles within the WordPress environment. Regular security audits should be conducted to ensure that custom code or third-party plugins do not introduce similar authorization bypasses. Furthermore, enabling comprehensive logging for administrative actions and data retrieval can help detect any anomalous access patterns indicative of exploitation attempts before significant damage occurs.