{
 "id": "WPSEC-2026-2636",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2636/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2636/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2636/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.12 - Unauthenticated Sensitive Information Exposure of Private and Pending Locations via Event Output and iCal Feed",
 "description": "The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via event output, the iCal feed and calendar links in all versions up to, and including, 7.4.12. This is due to the plugin deciding whether to show an event's venue from the location_status column, which is 1 for private locations, and the iCal template outputting any linked location without a visibility check. This makes it possible for unauthenticated attackers to view the name, address and coordinates of private, pending or draft venues attached to published events.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.4.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.4.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.4.13",
 "remediation": "Update to 7.4.13 or later.",
 "fix_released": "2026-11-05T08:02:10+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T11:59:15.953314+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2636/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.13/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-06"
 }
}