{"id":"CVE-2026-82214","kind":"vulnerability","aliases":["CVE-2026-82214"],"related":[],"title":"WordPress Quick Event Manager plugin leaks draft and private posts to anonymous visitors","description":"The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.","summary":"The Quick Event Manager WordPress plugin before 9.19 returns the details of a requested post through its calendar export without checking whether the post is a draft or private. An unauthenticated visitor can read the content of draft and private posts on the site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","quick-event-manager","wordpress","wordpress-plugin"],"not_affected_if":["plugin-9.19-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Quick Event Manager plugin version in the WordPress admin plugins list or in `wp-content/plugins/` and compare it with `9.19`.","fix":"- Quick Event Manager: `9.19` or later, per the description (before 9.19 is affected).","status":"open","published_at":"2026-10-31T06:16:34+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:23+00:00","updated_at":"2026-10-31T06:34:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-31T06:34:23Z","model":"claude-haiku-5-5","output":{"fix":"- Quick Event Manager: `9.19` or later, per the description (before 9.19 is affected).","reach":"internet","title":"WordPress Quick Event Manager plugin leaks draft and private posts to anonymous visitors","impact":"medium","summary":"The Quick Event Manager WordPress plugin before 9.19 returns the details of a requested post through its calendar export without checking whether the post is a draft or private. An unauthenticated visitor can read the content of draft and private posts on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","quick-event-manager"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"anonymous visitors read draft and private post content","analyst_note":"","how_to_check":"- Check the installed Quick Event Manager plugin version in the WordPress admin plugins list or in `wp-content/plugins/` and compare it with `9.19`.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-9.19-or-later"],"who_is_affected":"Sites running the Quick Event Manager WordPress plugin before version 9.19 that expose its calendar export. The exposure comes from the export endpoint returning post details without a status or type check, so sites that do not use the plugin's calendar export are less exposed. Sites that keep draft or private posts with sensitive content are the most at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4086,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-82214':16A,19A '9.19':36B,80C 'allow':100C 'anonym':12A 'calendar':46B,98C 'check':49B 'content':64B,106C 'cve':14A,17A 'detail':39B,95C 'draft':7A,55B,66B,108C 'event':3A,23B,31B,75C 'export':47B,99C 'leak':6A 'manag':4A,24B,32B,76C 'packag':20B 'plugin':5A,28B,34B,78C 'post':10A,43B,52B,69B,91C,111C 'privat':9A,57B,68B,110C 'quick':2A,22B,30B,74C 'quick-event-manag':21B 'read':62B,104C 'request':42B,90C 'return':37B,93C 'site':72B 'status':85C 'type':87C 'unauthent':59B,101C 'user':102C 'verifi':83C 'visitor':13A,60B 'whether':50B 'without':48B 'wordpress':1A,25B,27B,33B,77C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Quick Event Manager WordPress plugin before version 9.19 that expose its calendar export. The exposure comes from the export endpoint returning post details without a status or type check, so sites that do not use the plugin's calendar export are less exposed. Sites that keep draft or private posts with sensitive content are the most at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82214","severity":null,"published_at":"2026-10-31T06:16:34+00:00","modified_at":"2026-10-31T06:16:34+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}