Description
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Quick Event Manager | 8.4.6 – < 9.19 | 9.19 |
References
- https://wpscan.com/vulnerability/b3ccecb9-4544-4944-a31a-f5aed7dcc95e/ exploit vdb-entry technical-description