CVE-2026-93662: Events Manager WordPress Information Leak

CVE-2026-93662 Overview

CVE-2026-93662 is an information disclosure vulnerability in the Events Manager WordPress plugin before version 7.4.5. The plugin fails to enforce the scope of its logged-in event and location search when a caller supplies a custom owner value. A low-privileged authenticated user can read other accounts' unpublished, pending, or trashed event and venue content, including full street addresses. The flaw is categorized under [CWE-200] Information Exposure.

Critical Impact
Authenticated users with low privileges can enumerate private event and venue data owned by other users, exposing non-public content and physical addresses stored in the Events Manager plugin.

Affected Products

Events Manager WordPress plugin versions prior to 7.4.5
WordPress sites running the vulnerable plugin with multiple event authors
Deployments allowing low-privileged user registration with event or venue access

Discovery Timeline

2026-09-24 - CVE-2026-93662 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93662

Vulnerability Analysis

The Events Manager plugin exposes a logged-in search endpoint for events and locations (venues). The endpoint is intended to restrict results to records owned by the authenticated caller. The plugin honors a client-supplied owner parameter without re-asserting it against the current session identity.

An attacker who authenticates with any low-privileged WordPress account can override the owner value in the request. The query returns records belonging to the specified owner regardless of post status. This includes records in draft, pending, future, and trash states that WordPress would otherwise hide from non-authors.

Returned records expose event metadata and the associated venue data. Venue data stored by Events Manager includes full street addresses, geographic coordinates, and contact information. The exposure violates the confidentiality boundary between tenant accounts on multi-author WordPress installations.

Root Cause

The server-side search handler trusts the owner identifier submitted by the client instead of binding the query to the current user ID from the session. The missing authorization check falls under broken access control, as described in [CWE-200]. The handler also fails to filter by post status, allowing non-published records to appear in results.

Attack Vector

Exploitation requires network access to the WordPress site and valid credentials for any account with permission to invoke the logged-in search. The attacker submits a crafted request that sets the owner field to a target user ID. The vulnerable endpoint returns the target's private event and venue entries, which the attacker parses from the response.

No code execution is possible through this flaw. The impact is limited to confidentiality of event and venue records managed by the plugin. Refer to the WPScan Vulnerability Report for the full technical write-up.

Detection Methods for CVE-2026-93662

Indicators of Compromise

HTTP requests to Events Manager AJAX or REST search endpoints that include an owner parameter not matching the authenticated session user
Repeated authenticated search requests from a single account iterating sequential owner identifiers
Access log entries showing low-privileged accounts retrieving responses containing event IDs outside their authored content

Detection Strategies

Review WordPress access logs for POST or GET requests to Events Manager search handlers with query parameters that explicitly set owner, owner_id, or similar fields
Correlate the authenticated WordPress user ID with the owner value in request bodies and flag mismatches
Deploy web application firewall rules that inspect Events Manager search endpoints and block requests where the owner parameter does not match the session cookie's user identity

Monitoring Recommendations

Enable verbose logging on the Events Manager plugin and forward logs to a central SIEM for correlation
Alert on bursts of search queries from a single low-privileged account within short time windows
Monitor for unusual read patterns against the wp_em_events and wp_em_locations database tables

How to Mitigate CVE-2026-93662

Immediate Actions Required

Upgrade the Events Manager plugin to version 7.4.5 or later on all WordPress installations
Audit low-privileged user accounts and remove any that are inactive or unnecessary
Review event and venue content for sensitive address data that may have already been exposed

Patch Information

The vendor fixed the issue in Events Manager 7.4.5. The patched release re-binds the logged-in search to the current session's user ID and enforces post-status filtering. Administrators should install the update through the WordPress plugin dashboard or by replacing the plugin files from the official repository. Validate the installed version matches 7.4.5 or newer after the update completes.

Workarounds

Restrict access to the Events Manager search endpoints through a web application firewall rule until the patch is applied
Temporarily disable the plugin on sites where no mitigating controls can be deployed
Limit event and venue creation to trusted editor-level accounts to reduce exposure of sensitive address data

bash

# Verify installed Events Manager version via WP-CLI
wp plugin get events-manager --field=version

# Update Events Manager to the patched release
wp plugin update events-manager --version=7.4.5