CVE-2026-82214— Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
Quick assessment
Affected
Unknown Quick Event Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Quick Event Manager WordPress 插件在 9.19 版本之前，在通过日历导出功能返回帖子详情时，未验证所请求帖子的状态或类型，导致未授权用户可以读取草稿和私密帖子的内容。
Possible ATT&CK Techniques 1 AI
T1086
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82214
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
Source: CVE Program / CVE List V5
Vulnerability Description
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Quick Event Manager | 8.4.6 ~ 9.19 | - |
|
II. Public POCs for CVE-2026-82214
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82214
请登录查看更多情报信息。
Other References for CVE-2026-82214 (1)
-
https://wpscan.com/vulnerability/b3ccecb9-4544-4944-a31a-f5aed7dcc95e/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-31 · 11 CVEs total
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback | |
| CVE-2026-118185 | Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting | |
| CVE-2026-118629 | All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure | |
| CVE-2026-118438 | Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute | |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker RE | |
| CVE-2026-118437 | BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion | |
| CVE-2026-118184 | Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation | |
| CVE-2026-118043 | Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal | |
| CVE-2026-110808 | Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_u | |
| CVE-2026-110042 | Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Set |
IV. Related Vulnerabilities
Same product: Quick Event Manager
-
CVE-2026-84847
WordPress Quick Event Manager plugin <= 9.17 - Broken Access -
CVE-2026-84848
WordPress Quick Event Manager plugin <= 9.17 - Cross Site Sc -
CVE-2023-23975
WordPress Quick Event Manager plugin <= 9.7.4 - Broken Acces -
CVE-2023-23979
WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable -
CVE-2022-46863
WordPress Quick Event Manager Plugin <= 9.6.4 is vulnerable
Same vendor: Unknown
-
CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery -
CVE-2026-118185
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Lim -
CVE-2026-118629
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private a -
CVE-2026-118438
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Im -
CVE-2026-118638
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Mod