Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
Affects the Quick Event Manager WordPress plugin versions 8.4.6 through 9.18 when the ICS calendar export is used. Fixed in 9.19.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 9.19
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Quick Event Manager plugin for WordPress is affected by this vulnerability. Unauthenticated visitors can download calendar (ICS) exports that reveal the content of draft and private posts, which should be restricted to authorized users.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Unknown Quick Event Manager
From 8.4.6 · fixed in 9.19
References 1
Questions about CVE-2026-82214
What does this mean?
Unauthenticated visitors can read the content of draft and private posts through the plugin's calendar export (ICS download) feature. No login is needed to request those posts.Source: wpscan.com
Am I affected, and how do I check?
Versions 8.4.6 through 9.18 of the Quick Event Manager WordPress plugin are affected, and the flaw is reached through the calendar export feature. Check the installed plugin version in the WordPress plugins screen to see which version is in use.Source: wpscan.com
What should I do about it?
Update Quick Event Manager to version 9.19 or later, which contains the fix.Source: wpscan.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data