The vulnerability exists in the Events Manager WordPress plugin prior to version 7.4. A REST endpoint (events-manager/v1/uploads) fails to perform an authorization check before serving files that are temporarily stored while a user is in the process of uploading. Because the temporary file identifier is high‑entropy and only communicated to the uploader, a third party cannot guess it. Nevertheless, any user who knows the identifier—such as the uploader or an attacker who has obtained the identifier by other means—can retrieve that file. The exposed content can include confidential or proprietary material, representing a possible confidentiality breach.

WordPress sites running the Events Manager plugin with a version older than 7.4. No specific sub‑version details are provided, so any version below 7.4 is considered vulnerable.

The flaw does not require privileged access or code execution; it is reachable via an unauthenticated HTTP GET to the REST route. Because the identifier is high‑entropy and deleted after submission or cleanup, the practical attack window is small, and guessing the key is impractical. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating that it has not yet been widely exploited. Nonetheless, a legitimate uploader could unintentionally expose their pending uploads if the identifier leaks to an unintended party. The CVSS base score is not supplied, but the impact is limited to information disclosure rather than code execution or elevated privileges.