{
 "id": "WPSEC-2026-1712",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1712/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1712/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1712/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.11 - Unauthenticated Sensitive Information Exposure of Pending and Private Locations via Events Map Data Request",
 "description": "The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the GlobalEventsMapData map data request in all versions up to, and including, 7.4.11, due to the handler outputting the full record and map balloon of each event's joined location without checking that location's own publication status or visibility. This makes it possible for unauthenticated attackers to retrieve the name, address, coordinates, description and other details of pending, draft and private locations attached to publicly listed events.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.4.12",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.4.12"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.4.12",
 "remediation": "Update to 7.4.12 or later.",
 "fix_released": "2026-10-26T10:11:12+00:00",
 "published": "2026-10-27T10:49:10+00:00",
 "updated": "2026-10-26T13:21:01.026344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1712/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.12/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}