CVE-2026-93662

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5

Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a low-privileged user to access unpublished, pending, or trashed event and venue content from other accounts, which may include full street addresses.

Recommendations Update the plugin to version 7.4.5 or later.