CVE-2026-18050 describes an information exposure vulnerability (CWE-200) in the Events Manager WordPress plugin versions prior to 7.4. The plugin fails to perform authorization checks on a REST API endpoint that serves temporarily stored file uploads. As a result, an unauthenticated attacker who obtains the temporary upload identifier can retrieve another user's in-progress upload. The identifier is high-entropy and only shared with the uploader, and temporary files are deleted after submission or cleanup, which reduces the likelihood of exploitation by guessing identifiers.

An attacker with knowledge of a valid temporary upload identifier can access another user's in-progress file upload without authentication. This could lead to unauthorized disclosure of sensitive data contained in the temporary upload. However, the risk is mitigated by the high entropy of the identifier, its limited disclosure, and automatic removal of temporary files, which collectively reduce the feasibility of unauthorized access through guessing.

No official fix or patch information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the REST API endpoints or implementing additional access controls where possible to limit exposure.