# Quick Event Manager <= 9.18 - Unauthenticated Sensitive Information Exposure via Calendar (.ics) Download

- **ID:** WPSEC-2026-1868
- **Plugin:** Quick Event Manager (`quick-event-manager`), https://wordpress.org/plugins/quick-event-manager/
- **Affected versions:** all versions before 9.19
- **Fixed in:** 9.19 (Update to 9.19 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quick-event-manager
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1868/

## Description

The Quick Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the calendar (.ics) download AJAX action in all versions up to, and including, 9.18. This is due to the download not checking the post type or status of the requested ID; its only check is a nonce that is printed publicly wherever the ICS button is shown. This makes it possible for unauthenticated attackers to retrieve the titles of arbitrary posts and the details of unpublished events, including draft and private ones.

## References

- https://wpsec.com/vuln/WPSEC-2026-1868/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/
- https://wordpress.org/plugins/quick-event-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1868/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.