Vulnerabilities / Quick Event Manager / WPSEC-2026-2686
Quick Event Manager <= 9.19.1 - Unauthenticated Missing Authorization to Password-Protected Event Registration
Medium 5.3
CWE-862Fixed in 9.19.2
- ID
- WPSEC-2026-2686
- Plugin
- Quick Event Manager (quick-event-manager)
- Affected
- all versions before 9.19.2
- Remediation
- Update to 9.19.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Quick Event Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Quick Event Manager plugin for WordPress is vulnerable to Missing Authorization in the AJAX event registration handler in all versions up to, and including, 9.19.1 due to the handler not checking whether an event is password protected and accepting post IDs of any post type. This makes it possible for unauthenticated attackers to register for password-protected events without knowing the password, and to submit registrations against posts that are not events.
References
- https://wpsec.com/vuln/WPSEC-2026-2686/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19.2/
- https://wordpress.org/plugins/quick-event-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS