Live › vulnerability › CVE-2026-82214
The Quick Event Manager WordPress plugin before 9.19 returns the details of a requested post through its calendar export without checking whether the post is a draft or private. An unauthenticated visitor can read the content of draft and private posts on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Quick Event Manager WordPress plugin before version 9.19 that expose its calendar export. The exposure comes from the export endpoint returning post details without a status or type check, so sites that do not use the plugin's calendar export are less exposed. Sites that keep draft or private posts with sensitive content are the most at risk.
No product ranges from the sources yet.
wp-content/plugins/ and compare it with 9.19.9.19 or later, per the description (before 9.19 is affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.
This page as .md · .json · in your agent: get_signal("CVE-2026-82214")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.