{
 "id": "WPSEC-2026-2687",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2687/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2687/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2687/index.md",
 "title": "Quick Event Manager <= 9.19.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Events",
 "description": "The Quick Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.19.1 because password protection on events is not enforced consistently. The ICS calendar download, the event content (unless an extra per-event flag was set), the event listing shortcode, the calendar shortcode and the social meta tags in the page head all output event details without checking whether the password has been entered. This makes it possible for unauthenticated attackers to read the description, address, times, image and calendar (.ics) details of password-protected events without knowing the password. Their titles and dates stay public, as WordPress core shows them.",
 "plugin": {
  "slug": "quick-event-manager",
  "name": "Quick Event Manager",
  "full_name": "Quick Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/quick-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quick-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quick-event-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.19.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.19.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.19.2",
 "remediation": "Update to 9.19.2 or later.",
 "fix_released": "2026-11-06T01:24:30+00:00",
 "published": "2026-11-07T01:41:32+00:00",
 "updated": "2026-11-06T12:04:19.942512+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2687/",
  "https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19.2/",
  "https://wordpress.org/plugins/quick-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quick-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}