{
 "id": "WPSEC-2026-1868",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1868/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1868/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1868/index.md",
 "title": "Quick Event Manager <= 9.18 - Unauthenticated Sensitive Information Exposure via Calendar (.ics) Download",
 "description": "The Quick Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the calendar (.ics) download AJAX action in all versions up to, and including, 9.18. This is due to the download not checking the post type or status of the requested ID; its only check is a nonce that is printed publicly wherever the ICS button is shown. This makes it possible for unauthenticated attackers to retrieve the titles of arbitrary posts and the details of unpublished events, including draft and private ones.",
 "plugin": {
  "slug": "quick-event-manager",
  "name": "Quick Event Manager",
  "full_name": "Quick Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/quick-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quick-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quick-event-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.19",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.19"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.19",
 "remediation": "Update to 9.19 or later.",
 "fix_released": "2026-10-27T19:03:52+00:00",
 "published": "2026-10-28T19:48:30+00:00",
 "updated": "2026-10-28T09:11:54.258517+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1868/",
  "https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/",
  "https://wordpress.org/plugins/quick-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quick-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}