The Events Manager WordPress plugin, in all versions before 7.4, contains a REST endpoint (events-manager/v1/uploads) that serves temporary file uploads without performing an authorization check. The endpoint returns the file identified by a high‑entropy temporary token, which is communicated only to the uploader. Because the identifier is not guessable, a victim can only retrieve the file if they already possess the token, leading to a potential confidentiality breach. The flaw is rooted in a lack of access control and improper information disclosure (CWE‑200).

WordPress sites that have the Events Manager plugin installed with any version lower than 7.4 are vulnerable. No additional sub‑version detail is provided, so all pre‑7.4 releases should be treated as affected.

An attacker can reach the vulnerable resource via an unauthenticated HTTP GET to the events-manager/v1/uploads route, supplying the known temporary identifier. Based on the description, it is inferred that the attacker must know the identifier, which is only sent to the uploader. The temporary files are deleted upon submission or by a scheduled clean‑up, making the exposure window short. The CVSS base score of 7.5 indicates high potential impact for information disclosure, while the EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited.