CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads
Unauthenticated attackers can retrieve other users' temporary file uploads if the high-entropy identifier is known, exposing sensitive data in Events Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18050?
CVE-2026-18050 is a high-severity missing authorization vulnerability in Unknown Events Manager, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.
Weakness: CWE-200
Which versions are affected by CVE-2026-18050?
How do I fix CVE-2026-18050?
No fix has been published for CVE-2026-18050 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-18050 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18050 exists.
Sources
Also known as GHSA-g34q-c4r9-fwhj.