Unauthorized Access Vulnerability in Events Manager Plugin for WordPress
CVE-2026-18050
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18050?
The Events Manager plugin for WordPress prior to version 7.4 lacks proper authorization checks on a REST route associated with file uploads. This flaw allows unauthenticated users to access another user's temporary file uploads if they possess knowledge of the temporary identifier, which is high-entropy and known only to the original uploader. Although the file is deleted either upon submission or through scheduled cleanup, this vulnerability could expose sensitive data inadvertently.
Affected Version(s)
Events Manager 0 < 7.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.