# Quick Event Manager <= 9.19.1 - Unauthenticated Missing Authorization to Password-Protected Event Registration

- **ID:** WPSEC-2026-2686
- **Plugin:** Quick Event Manager (`quick-event-manager`), https://wordpress.org/plugins/quick-event-manager/
- **Affected versions:** all versions before 9.19.2
- **Fixed in:** 9.19.2 (Update to 9.19.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quick-event-manager
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2686/

## Description

The Quick Event Manager plugin for WordPress is vulnerable to Missing Authorization in the AJAX event registration handler in all versions up to, and including, 9.19.1 due to the handler not checking whether an event is password protected and accepting post IDs of any post type. This makes it possible for unauthenticated attackers to register for password-protected events without knowing the password, and to submit registrations against posts that are not events.

## References

- https://wpsec.com/vuln/WPSEC-2026-2686/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19.2/
- https://wordpress.org/plugins/quick-event-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2686/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.