CVE-2026-18050

17th percentile - higher than 17% of all known CVEs

The Events Manager WordPress plugin before version 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

The risk is limited because the identifier is hard to guess, but if disclosed through other means, an unauthenticated attacker could access another user's unsubmitted files, potentially compromising data confidentiality.

Update the Events Manager plugin to version 7.4 or later, which includes a fix adding authorization checks on the REST route.