CVE-2026-18050

The CVE concerns the WordPress plugin Events Manager before 7.4 . A REST route under events-manager/v1/uploads lacks authorization, allowing unauthenticated access to a user’s in-progress, temporarily stored upload. The identifier is high-entropy and only disclosed to the uploader; the file is re...