CVE-2026-10029

Name of the Vulnerable Software and Affected Versions Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress versions prior to 1.3.13.2

Description Sensitive information exposure occurs via the get events function. This allows unauthenticated attackers to extract sensitive data from draft, pending, and private events that are not accessible through public URLs. The exposed data includes virtual meeting URLs, physical location data, latitude/longitude coordinates, Google Maps links, and RSVP configuration.

Recommendations Update the plugin to a version later than 1.3.13.1. As a temporary workaround, restrict access to the get events function to minimize the risk of exploitation.