CVE-2026-10627mediumCWE-862

CVE-2026-10627: fallo de gravedad media en netweblogic Events Manager – Calendar…

Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Events Manager – Calendar, Bookings, Tickets, and more!

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.6%
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view the titles, dates, descriptions, and location details of events and locations that administrators have marked as draft, pending, trashed, or private.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
netweblogic · Events Manager – Calendar, Bookings, Tickets, and more!
CVEs relacionadas — netweblogic Events Manager – Calendar…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-6970HIGHEvents Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` ParameterEPSS 56.4%CVE-2026-14280MEDIUMEvents Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array KeysEPSS 1.2%CVE-2024-0614MEDIUMEvents Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settingsEPSS 0.7%CVE-2024-11260HIGHEvents Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status ParameterEPSS 0.6%CVE-2026-15023MEDIUMEvents Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate ActionEPSS 0.6%CVE-2026-17089MEDIUMEvents Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' ParameterEPSS 0.5%