medium4.3
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner val…
Impact
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
Affected products
| Product | Affected versions |
|---|---|
| Events Manager WordPress Plugin | before 7.4.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.