CVE-2026-10627: WordPress Events Manager Authorization Bypass

CVE-2026-10627 Overview

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 7.4.0. The plugin fails to verify whether a requesting user is authorized to view non-public event data. Unauthenticated attackers can retrieve titles, dates, descriptions, and location details of events and locations that administrators marked as draft, pending, trashed, or private. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can enumerate and disclose non-public event and location metadata that site administrators intended to keep hidden.

Affected Products

Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress, versions up to and including 7.4.0
WordPress sites running the plugin at versions 7.2.3.1 and 7.3.1 (references)
Patched in the 7.4.0.1 to 7.4.1 changeset

Discovery Timeline

2026-08-25 - CVE-2026-10627 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-10627

Vulnerability Analysis

The vulnerability is a missing authorization check ([CWE-862]) in the Events Manager plugin's event and location retrieval logic. The plugin exposes query paths that return event and location records without confirming that the requesting user has permission to view non-published content. As a result, records with a status of draft, pending, trash, or private are returned to unauthenticated clients alongside published records.

The disclosed fields include event titles, start and end dates, descriptions, and location details. While the impact is limited to confidentiality of metadata, disclosed drafts often contain internal planning notes, unannounced events, or private venue information that administrators explicitly gated.

Root Cause

The root cause is the absence of a capability or status check inside the plugin's event and object query classes. Referenced upstream code paths include classes/em-events.php (line 654), classes/em-object.php (lines 314 and 1166), and handlers in em-actions.php (lines 823 and 906). These paths build SQL queries and action responses without filtering out post statuses that require read_private_posts or equivalent capabilities.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to the WordPress site invoking the vulnerable plugin endpoints or query parameters. Because no authentication or authorization is required, the request completes over the network with low complexity. The server responds with event and location data regardless of the item's non-public status. The attacker parses the response to enumerate hidden events and their attributes. See the Wordfence Vulnerability Report for additional advisory details.

No verified public proof-of-concept code is available. The vulnerability is described in prose per available references.

Detection Methods for CVE-2026-10627

Indicators of Compromise

Unauthenticated HTTP requests targeting Events Manager endpoints returning event objects containing status values of draft, pending, trash, or private.
Anomalous volumes of requests to em-actions.php or event query URLs from single source IPs enumerating event IDs.
Web server access logs showing successful 200 OK responses to unauthenticated clients requesting event listings with non-default status filters.

Detection Strategies

Inspect application logs for GET or POST requests to plugin action handlers referencing event or location objects without an authenticated session cookie.
Deploy web application firewall rules to flag requests that request or return event records with non-published statuses.
Baseline normal traffic to /wp-admin/admin-ajax.php and public event endpoints, and alert on deviations consistent with scraping behavior.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform and correlate with plugin version inventory.
Track the installed Events Manager plugin version across WordPress hosts and alert when versions at or below 7.4.0 are detected.
Monitor outbound content leakage indicators, such as unusual JSON responses containing draft or private event descriptions.

How to Mitigate CVE-2026-10627

Immediate Actions Required

Update the Events Manager plugin to version 7.4.1 or later on all WordPress installations.
Audit event and location records for entries marked as draft, pending, trash, or private to identify data that may have been disclosed.
Restrict administrative and plugin endpoints behind a web application firewall while patching is scheduled.

Patch Information

The vendor addressed the missing authorization check in the changeset between versions 7.4.0.1 and 7.4.1. Review the WordPress EM Version Change 7.4.0.1 to 7.4.1 for the exact code fixes applied to classes/em-events.php, classes/em-object.php, and em-actions.php.

Workarounds

If immediate patching is not feasible, disable the Events Manager plugin until it can be upgraded to 7.4.1.
Use a WAF or reverse proxy rule to block unauthenticated requests to event query endpoints that request non-public statuses.
Remove or reclassify sensitive information from event drafts and private events until the patch is applied.

bash

# Configuration example: verify installed Events Manager plugin version via WP-CLI
wp plugin get events-manager --field=version

# Upgrade to the patched release
wp plugin update events-manager --version=7.4.1