CVE-2026-18050 describes an information exposure vulnerability (CWE-200) in the Events Manager WordPress plugin prior to version 7.4. The plugin's REST API endpoint serving temporarily stored file uploads lacks authorization checks, enabling unauthenticated users to retrieve files uploaded by others if they possess the temporary identifier. The identifier is high-entropy and only shared with the uploader, and files are deleted after submission or cleanup, which reduces the likelihood of exploitation through guessing. No official patch or remediation level has been published yet.

An attacker who obtains the temporary identifier can access another user's in-progress file upload, leading to unauthorized disclosure of potentially sensitive information. Since the identifier is high-entropy and only known to the uploader, and files are removed promptly, the risk of exploitation is limited but still significant given the potential confidentiality breach. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoints serving temporary uploads where possible and monitor for unauthorized access attempts. Avoid sharing temporary upload identifiers and ensure cleanup processes are functioning correctly.