# Quick Event Manager <= 9.19.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Events

- **ID:** WPSEC-2026-2687
- **Plugin:** Quick Event Manager (`quick-event-manager`), https://wordpress.org/plugins/quick-event-manager/
- **Affected versions:** all versions before 9.19.2
- **Fixed in:** 9.19.2 (Update to 9.19.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quick-event-manager
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2687/

## Description

The Quick Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.19.1 because password protection on events is not enforced consistently. The ICS calendar download, the event content (unless an extra per-event flag was set), the event listing shortcode, the calendar shortcode and the social meta tags in the page head all output event details without checking whether the password has been entered. This makes it possible for unauthenticated attackers to read the description, address, times, image and calendar (.ics) details of password-protected events without knowing the password. Their titles and dates stay public, as WordPress core shows them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2687/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19.2/
- https://wordpress.org/plugins/quick-event-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2687/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.