CVE-2026-93662: Unknown Events Manager

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.

Affected products

• Unknown Events Manager: from 7.4.1, before 7.4.5 (fixed in 7.4.5)

Published 2026-09-24. Last modified 2026-09-24.