{"id":"CVE-2026-93662","aliases":["EUVD-2026-85809","GHSA-wvr6-m4wg-qf6q"],"status":"published","title":"Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter","description":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00196,"percentile":0.09373,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-09-24T06:00:20Z","modified":"2026-09-24T14:42:02Z","products":[{"vendor":"pixelite","product":"events manager"},{"vendor":"unknown","product":"events manager"}],"references":[{"url":"https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93662"},{"url":"https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049"},{"url":"https://github.com/advisories/GHSA-wvr6-m4wg-qf6q"}],"sources":{"cve":[{"id":"CVE-2026-93662","title":"Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter","description":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","status":"published","published":"2026-09-24T06:00:20.691Z","modified":"2026-09-24T10:41:54.239Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-85809","description":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","status":"published","published":"2026-09-24T06:00:20Z","modified":"2026-09-24T10:41:54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-wvr6-m4wg-qf6q","title":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event...","description":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","status":"published","published":"2026-09-24T06:31:16Z","modified":"2026-09-24T12:32:26Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:22.2852Z"}],"nvd":[{"id":"CVE-2026-93662","description":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.","status":"published","published":"2026-09-24T06:17:04.05Z","modified":"2026-09-24T14:42:02.707Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:51.036099Z"}]}}