{
 "id": "WPSEC-2026-2686",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2686/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2686/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2686/index.md",
 "title": "Quick Event Manager <= 9.19.1 - Unauthenticated Missing Authorization to Password-Protected Event Registration",
 "description": "The Quick Event Manager plugin for WordPress is vulnerable to Missing Authorization in the AJAX event registration handler in all versions up to, and including, 9.19.1 due to the handler not checking whether an event is password protected and accepting post IDs of any post type. This makes it possible for unauthenticated attackers to register for password-protected events without knowing the password, and to submit registrations against posts that are not events.",
 "plugin": {
  "slug": "quick-event-manager",
  "name": "Quick Event Manager",
  "full_name": "Quick Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/quick-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quick-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quick-event-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.19.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.19.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.19.2",
 "remediation": "Update to 9.19.2 or later.",
 "fix_released": "2026-11-06T01:24:30+00:00",
 "published": "2026-11-07T01:41:32+00:00",
 "updated": "2026-11-06T12:04:19.942512+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2686/",
  "https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19.2/",
  "https://wordpress.org/plugins/quick-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quick-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}