Quick Event Manager <= 9.19.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Events
- ID
- WPSEC-2026-2687
- Plugin
- Quick Event Manager (quick-event-manager)
- Affected
- all versions before 9.19.2
- Remediation
- Update to 9.19.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Quick Event Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Quick Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.19.1 because password protection on events is not enforced consistently. The ICS calendar download, the event content (unless an extra per-event flag was set), the event listing shortcode, the calendar shortcode and the social meta tags in the page head all output event details without checking whether the password has been entered. This makes it possible for unauthenticated attackers to read the description, address, times, image and calendar (.ics) details of password-protected events without knowing the password. Their titles and dates stay public, as WordPress core shows them.
References
- https://wpsec.com/vuln/WPSEC-2026-2687/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19.2/
- https://wordpress.org/plugins/quick-event-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS