CVE-2026-10627

MEDIUM 5.3

Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view the titles, dates, descriptions, and location details of events and locations that administrators have marked as draft, pending, trashed, or private.

CWE	CWE-862
Vendor	netweblogic
Product	events manager – calendar, bookings, tickets, and more!
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for netweblogic events manager – calendar, bookings, tickets, and more!

Be the first to know when new medium vulnerabilities affecting netweblogic events manager – calendar, bookings, tickets, and more! are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

netweblogic / Events Manager – Calendar, Bookings, Tickets, and more!

0 ≤ 7.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

molten bit