Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets for WordPress is vulnerable to sensitive information exposure via its get_events REST API endpoint. The flaw allows an unauthenticated attacker to retrieve confidential details such as virtual meeting URLs, physical location data, latitude/longitude coordinates, Google Maps links, and RSVP configuration for events that are in draft, pending, or private status. This disclosure can lead to privacy violations and compromise of event logistics that remain otherwise protected from public access.

The vulnerability affects all installations of the Event Koi Lite plugin for WordPress up to and including version 1.3.13.1. Administrators running these older versions should review their plugin versions and update if possible.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1 % suggests limited observed exploitation. Although it is not listed in the CISA KEV catalog, the attack surface is open to any unauthenticated user who can reach the REST API. If exploited, an attacker can harvest sensitive data, potentially leading to privacy breaches and operational disruptions. The attack vector is inferred to be an unauthenticated HTTP request to the get_events endpoint, which the plugin currently does not protect with an authorization check as documented by CWE‑862.