PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-82214 WordPress.org CVE debrief

CVE-2026-82214 debrief based on CVE Program and NVD records. The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts. This vulnerability affects WordPress installations using the Quick Event Manager plugin. Defenders should assess exposure and prioritize verification of plugin version and access controls.

Vendor
WordPress.org
Product
Quick Event Manager plugin
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-31
Original CVE updated
2026-11-01
Advisory published
2026-10-31
Advisory updated
2026-11-01

Who should care

Defenders of WordPress installations using the Quick Event Manager plugin should assess exposure and prioritize verification of plugin version and access controls

Why it matters

CVE-2026-82214 allows unauthenticated users to read draft and private post content through a calendar export in the Quick Event Manager WordPress plugin. Defenders of WordPress installations using this plugin should assess exposure, prioritize verification of plugin version and access controls, and monitor for suspicious activity related to post content disclosure.

  • Read access to sensitive draft and private post content
  • Potential data exposure through calendar export functionality
  • Need for verification of plugin version and access controls
  • Possible impact on confidentiality of post content

Technical summary

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts. This vulnerability allows unauthenticated users to access sensitive post content, potentially leading to data exposure. Defenders should verify plugin version and restrict access to calendar export functionality.

Defensive priority

Assess exposure of WordPress installations using Quick Event Manager plugin

Recommended defensive actions

  • Inventory WordPress installations using Quick Event Manager plugin
  • Verify plugin version is 9.19 or later
  • Restrict access to calendar export functionality
  • Monitor for suspicious activity related to post content disclosure

Evidence notes

The Quick Event Manager WordPress plugin before 9.19 does not verify post status or type before returning details through a calendar export. This allows unauthenticated users to read draft and private post content.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-82214 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-82214

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-82214 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-82214

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.