CVE-2026-82214: Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

Published Oct 31, 2026

Updated

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed?

WordPress sites using Quick Event Manager versions before 9.19 are affected. Exposure exists when the plugin has draft or private posts whose details can be requested through the calendar export functionality.

What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction. They can request a calendar export for a targeted post because the plugin does not verify the post's status or type before returning details.

What information can be disclosed?

The issue allows unauthenticated disclosure of the content of draft and private posts. The provided information does not indicate integrity impact or service disruption.

How can the issue be remediated?

Update Quick Event Manager to version 9.19 or later. The affected versions are those before 9.19.

CVE-2026-82214: Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

Event History

Frequently Asked Questions

Which sites are exposed?

What does an attacker need to exploit this issue?

What information can be disclosed?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed?

What does an attacker need to exploit this issue?

What information can be disclosed?

How can the issue be remediated?