Vulnerabilities / Events Manager – Calendar, Bookings, Tickets, Appointments and more! / WPSEC-2026-2636
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.12 - Unauthenticated Sensitive Information Exposure of Private and Pending Locations via Event Output and iCal Feed
Medium 5.3
CWE-200Fixed in 7.4.13
- ID
- WPSEC-2026-2636
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.13
- Remediation
- Update to 7.4.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via event output, the iCal feed and calendar links in all versions up to, and including, 7.4.12. This is due to the plugin deciding whether to show an event's venue from the location_status column, which is 1 for private locations, and the iCal template outputting any linked location without a visibility check. This makes it possible for unauthenticated attackers to view the name, address and coordinates of private, pending or draft venues attached to published events.
References
- https://wpsec.com/vuln/WPSEC-2026-2636/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.13/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS