CVE-2026-93662
Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
| Vendor | unknown |
| Product | events manager |
| Published | Sep 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown events manager
Be the first to know when new unknown vulnerabilities affecting unknown events manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Events Manager
7.4.1 < 7.4.5
References
Credits
Karthik Ramakrishnan WPScan