The Events Manager WordPress plugin does not enforce the correct scope for logged‑in event and location searches when a caller supplies an explicit 'owner' parameter. This deficiency allows an authenticated user with low privileges to view unpublished, pending, or trashed events and venue details from other accounts, including complete street addresses. The vulnerability exposes sensitive business and personal data that would normally be restricted, thereby compromising confidentiality.

WordPress sites running the Events Manager plugin prior to version 7.4.5 are affected. Version 7.4.5 or later includes the fix and is not vulnerable.

The description indicates that an attacker must be authenticated on the WordPress site to supply the 'owner' parameter; this inference is based on the phrase 'allows a low‑privileged user'. Once authenticated, the attacker can request event or location data belonging to other users by adding the 'owner' parameter to a legitimate search request. The CVSS score is 4.3 and the EPSS score of less than 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The potential to expose private venue addresses and unpublished events indicates a noteworthy confidentiality risk. No publicly disclosed exploit is currently known; however, the possibility of informational leakage warrants timely remediation.