# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.12 - Unauthenticated Sensitive Information Exposure of Private and Pending Locations via Event Output and iCal Feed

- **ID:** WPSEC-2026-2636
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** all versions before 7.4.13
- **Fixed in:** 7.4.13 (Update to 7.4.13 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2636/

## Description

The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via event output, the iCal feed and calendar links in all versions up to, and including, 7.4.12. This is due to the plugin deciding whether to show an event's venue from the location_status column, which is 1 for private locations, and the iCal template outputting any linked location without a visibility check. This makes it possible for unauthenticated attackers to view the name, address and coordinates of private, pending or draft venues attached to published events.

## References

- https://wpsec.com/vuln/WPSEC-2026-2636/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.13/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2636/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.