CVE-2026-18050 Events Manager CVE debrief

Who should care

Users of the Events Manager WordPress plugin, particularly those with versions before 7.4, should be aware of this vulnerability and take immediate action to update or mitigate the risk. This includes performing inventory checks, verifying plugin versions, and monitoring for suspicious activity related to file uploads and retrievals.

Technical summary

The Events Manager WordPress plugin before version 7.4 does not perform authorization checks on a REST route that serves temporary file uploads. This allows unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy and only disclosed to the uploader. The file is removed upon submission or scheduled cleanup, limiting the risk of cross-user reads via guessing. This vulnerability has a CVSS score of 7.5 and is considered HIGH severity.

Defensive priority

Unauthenticated users can retrieve in-progress file uploads from the Events Manager WordPress plugin before version 7.4. Perform immediate inventory checks and verify plugin version.

Recommended defensive actions

• Perform immediate inventory checks to identify instances of the Events Manager WordPress plugin before version 7.4
• Verify plugin version and update to 7.4 or later
• Monitor for suspicious activity related to file uploads and retrievals
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Events Manager WordPress plugin before 7.4 does not perform authorization checks on a REST route for temporary file uploads. This allows unauthenticated users to retrieve another user's in-progress upload if the temporary identifier is known. The identifier is high-entropy and only disclosed to the uploader. The file is removed upon submission or scheduled cleanup, limiting the risk of cross-user reads via guessing.

Official resources