CVE-2026-10627

Executive Summary

CVE-2026-10627 is an authorization bypass vulnerability affecting the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress in all versions up to and including 7.4.0. The vulnerability stems from the plugin's failure to properly verify that a user is authorized to perform an action, allowing unauthenticated attackers to access the titles, dates, descriptions, and location details of events and locations that administrators have designated as draft, pending, trashed, or private. This information disclosure vulnerability carries a CVSS base score of 5.3, and as of the current reporting date, no patch is available, making all deployments running affected versions actively exposed to this data leakage.

Technical Analysis

The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaws where a web application fails to enforce proper access control checks before exposing sensitive resources or executing privileged operations. In this specific case, the Events Manager plugin for WordPress exposes event and location metadata through its publicly accessible endpoints without validating whether the requesting user has the necessary permissions to view content in non-public statuses.

The affected data objects include events and locations with the statuses of draft, pending, trashed, and private. In WordPress, these statuses are traditionally reserved for internal viewing — drafts are in-progress content, pending items are awaiting review, trashed items are in the recycle bin, and private items are restricted to authors and administrators. The plugin appears to serialize or expose these records through AJAX endpoints, REST API routes, or shortcode handlers that render calendar and listing views, and these handlers fail to query only for published content or to check user capabilities before returning results.

The specific technical mechanism is an authorization check omission: the plugin does not verify that the user is authorized to perform the action (viewing the event/location data) before executing it. This is distinct from an authentication bypass — the attacker does not need valid credentials, which aligns with the CVSS vector showing PR:N (No Privileges Required) and UI:N (No User Interaction Required). The attack vector is network-based (AV:N), the attack complexity is low (AC:L), and the impact is limited to confidentiality (C:L), with no integrity or availability impact.

Insufficient technical detail is available to identify the exact function names, endpoint paths, or SQL queries involved, as the NVD description does not provide code-level specifics. The vulnerability class, however, is well understood: it falls within the category of Insecure Direct Object Reference (IDOR) or Missing Authorization Layer, where a resource that should be gated behind a permission check is rendered or serialized without that gate.

Exploitation Scenarios

No public PoC is available for this vulnerability; the attack chain described below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/Target Identification: An attacker identifies WordPress sites running the Events Manager plugin, version 7.4.0 or earlier. This can be accomplished through web fingerprinting — detecting the plugin's typical asset paths (e.g., JavaScript/CSS file references under the plugin directory), examining page source for plugin-specific shortcodes or calendar widgets, or using CMS/plugin vulnerability scanners. Shodan can also identify such targets via HTML fingerprinting of the plugin's resources.

2. Triggering the Flaw: The attacker sends HTTP requests to the plugin's publicly accessible data endpoints without any authentication. Because the plugin fails to verify user authorization before serving event/location data, these requests return results that include objects in draft, pending, trashed, and private statuses. The attacker does not need to manipulate session tokens, forge cookies, or bypass login mechanisms — the access control check is simply absent.

3. Payload/Execution Method: At the vulnerability-class level, the request is a standard HTTP GET (or POST for AJAX-driven interfaces) to the plugin's calendar, events list, or location listing endpoints. The attacker may manipulate query parameters (such as status filters or post-type parameters) to explicitly request non-public content, or the plugin may unintentionally include all statuses in its default queries. No injection payload is required — the flaw is purely a missing authorization gate.

4. Post-Exploitation Impact: The attacker collects the sensitive metadata: event titles, dates, descriptions, and location details for content that administrators intended to keep private or unpublished. This can reveal confidential business information (e.g., planned product launches, private corporate events, unreleased pricing strategies), internal operational schedules, or physical location data. This information can feed further reconnaissance for social engineering, competitive intelligence gathering, or physical security assessments.

Impact Assessment

The vulnerability's CVSS base score is 5.3 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The most significant factors are the unauthenticated network-based access (AV:N, PR:N) and the absence of user interaction (UI:N), which make the vulnerability trivially exploitable at scale by any remote attacker.

Confidentiality Impact: Scored as Low (C:L) because the exposed data is metadata (titles, dates, descriptions, locations) rather than credentials, PII, or financial records. However, the aggregate business impact can be substantial — a draft event description might contain sensitive operational details, competitive strategies, or internal project information that admins deliberately withheld from public view.

Integrity and Availability Impact: None. The attacker cannot modify, delete, or disrupt any data or services.

Affected Systems: All WordPress installations running the Events Manager plugin (versions up to and including 7.4.0) where the plugin is active (not merely installed). The blast radius is broad given the plugin's popularity in the WordPress ecosystem — the name "Calendar, Bookings, Tickets, and more!" indicates a feature-rich plugin likely used by event management companies, venues, educational institutions, and organizations that rely on ticketed or RSVP-based events.

Attack Surface: Public-facing WordPress sites are directly reachable over the internet. No prior foothold, valid credentials, or network positioning is required. This makes the vulnerability automatable and suitable for mass-scanning campaigns.

Detection Guidance

Detection for this vulnerability is challenging because the flaw manifests as legitimate-looking requests returning unauthorized content — there is no malicious payload. Detection must therefore focus on anomalous request patterns (e.g., mass enumeration attempts) and on server-side logging that reveals access to non-public content without valid sessions.

Sigma Rule

title: WP Events Manager - Unauthenticated Access to Non-Public Events
id: e9b3f1c4-8a2e-4e7d-9a3b-5f2c0e1d4a67
status: experimental
description: Detects unauthenticated HTTP requests to WordPress Events Manager endpoints that may expose draft, pending, trashed, or private event/location data (CVE-2026-10627).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10627
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.10627
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs'
detection:
    selection_events:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'events-manager'
            - 'event'
            - 'location'
    selection_status:
        cs-uri-query|contains|all:
            - 'status'
            - 'draft'
            - 'pending'
            - 'trash'
            - 'private'
    filter_logged_in:
        cs-username|exists: false
    condition: selection_events and selection_status and filter_logged_in
falsepositives:
    - Custom admin tools or monitoring plugins that fetch content without authentication
    - Misconfigured plugins that legitimately render draft content for preview
level: medium

YARA Rule

rule WP_EventsManager_Unauth_Access_CVE_2026_10627
{
    meta:
        author = "Valterits Threat Intel"
        description = "Detects HTTP request patterns targeting WordPress Events Manager plugin with explicit non-public status parameters"
        cve = "CVE-2026-10627"
        date = "2026-04-30"
        severity = "medium"
    strings:
        $plugin_path = "/wp-content/plugins/events-manager/" ascii nocase
        $events_shortcode = "events-manager" ascii nocase
        $calendar_search = "calendar" ascii nocase
        $event_action = "event_action" ascii nocase
        $draft_param = "draft" ascii nocase
        $pending_param = "pending" ascii nocase
        $trash_param = "trash" ascii nocase
        $private_param = "private" ascii nocase
    condition:
        uint16(0) == 0x0d0a and
        ($plugin_path or $events_shortcode) and
        ($draft_param or $pending_param or $trash_param or $private_param)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"WP Events Manager Unauthenticated Non-Public Content Access (CVE-2026-10627)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin-ajax.php";
    http.uri; content:"action=events_manager";
    http.uri; content:"status";
    http.uri; content:"draft";
    sid:20261062701;
    rev:1;
    metadata:attack_target Web_Server, created_at 2026_04_30, cve CVE-2026-10627, deployment Perimeter, signature_severity Medium, tag WordPress;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-10627;
    classtype:attempted-recon;
)

Elastic Detection

// EQL query to detect unauthenticated requests to Events Manager endpoints with non-public status parameters
sequence by source.ip with maxspan=5m
  [network where destination.port == 80 or destination.port == 443
   and url.path contains "/wp-admin/admin-ajax.php"
   and url.query contains "action" and url.query contains "events"
   and not user.name : "*"]
  [network where destination.port == 80 or destination.port == 443
   and url.query contains "status" and (url.query contains "draft" or url.query contains "pending" or url.query contains "trash" or url.query contains "private")]

Splunk SPL Query

index=web sourcetype=access_combined
| where NOT (user IS NOT NULL AND user != "-")
| where like(uri_path, "%events-manager%") OR like(uri_path, "%admin-ajax.php%")
| where like(uri_query, "%status%") AND (like(uri_query, "%draft%") OR like(uri_query, "%pending%") OR like(uri_query, "%trash%") OR like(uri_query, "%private%"))
| stats count by src_ip, uri_path, uri_query, status, user_agent
| sort - count
| where count > 5
| table _time, src_ip, uri_path, uri_query, status, user_agent, count

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="524947" level="8">
        <decoded_as>web</decoded_as>
        <description>Potential unauthorized access to non-public Events Manager content (CVE-2026-10627)</description>
        <group>wp_events_manager_unauth,</group>
        <match>events-manager|admin-ajax.php</match>
        <regex>status=(draft|pending|trash|private)</regex>
        <if_sid>31100</if_sid>
        <options>no_full_log</options>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
    <rule id="524948" level="10" frequency="10" timeframe="60">
        <if_matched_sid>1062701</if_matched_sid>
        <description>Repeated attempts to access non-public Events Manager content from same source (CVE-2026-10627)</description>
        <group>wp_events_manager_unauth_repeat,</group>
        <same_source_ip/>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence exists from any tracked source. The vendor (developer of the Events Manager plugin) has not released a fixed version, and there is no vendor advisory available. No workarounds have been officially documented.

Immediate Mitigations (while unpatched):

1. Disable or Deactivate the Plugin: If the Events Manager plugin is not essential to core business operations, deactivate it immediately. This is the most effective mitigation since the vulnerable code will no longer execute.
2. Restrict Network Access: Implement web application firewall (WAF) rules to block requests to the plugin's data endpoints from non-authenticated users. Specifically, block requests to admin-ajax.php or REST endpoints that reference events/location data without a valid session cookie.
3. Enforce Authentication at the Reverse Proxy: If feasible, require authentication at the reverse proxy layer for any URL paths associated with the Events Manager plugin's data retrieval.
4. Limit Exposure via .htaccess: Add rules to the WordPress .htaccess file that deny access to plugin-specific AJAX endpoints from untrusted IP ranges, though this may break legitimate functionality.

Patch/Upgrade Steps:

1. Monitor for Plugin Updates: Since the plugin is distributed through the WordPress plugin repository, subscribe to its changelog or security announcements. When the vendor releases a version later than 7.4.0 with a security fix, upgrade immediately.
2. Check the WordPress Plugin Repository Page: Visit the plugin's official page on wordpress.org and check the "Change Log" section for a security update referencing this CVE.
3. Test in Staging: Before applying any update, deploy and test in a staging environment that mirrors production configuration, especially if the plugin is heavily customized.

Long-Term Hardening:

1. Maintain a Plugin Update Cadence: Regularly update all WordPress plugins to the latest versions. Subscribe to WordPress security mailing lists and vulnerability databases.
2. Remove Unused Plugins: Deactivate and delete any plugins not actively used in production.
3. Harden WordPress Access Control: Restrict access to wp-admin and admin-ajax.php via IP allowlisting, and enforce strong authentication policies for all backend users.
4. Web Application Firewall (WAF): Deploy a WAF with WordPress-specific rule sets (e.g., OWASP ModSecurity Core Rule Set) to provide a safety net for missing authorization checks.
5. Monitor Plugin Security Advisories: Track CVE feeds and WordPress-specific security communities for future disclosures involving this plugin.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10627
2. WordPress Plugin Repository (Events Manager) — track for updates: https://wordpress.org/plugins/events-manager/
3. CWE-862 Missing Authorization Reference: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (for confirmation that this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Awareness: No known threat actor campaigns, exploit-in-the-wild evidence, or public PoC exploitation has been reported for CVE-2026-10627 as of the current reporting date. However, the unpatched status combined with the plugin's broad installation base creates a significant risk window; mass-scanning botnets frequently target WordPress plugin vulnerabilities of this class shortly after disclosure. Security teams should re-evaluate this CVE if and when a patch is released, as public security advisories often trigger exploit attempts.