Is CVE-2026-10627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10627 being exploited in the wild.

How severe is CVE-2026-10627?

Medium severity, with a CVSS score of 5.3, published 25 August 2026.

Which products and versions are affected?

Barn2 Media Events Manager up to and including 7.4.0.

Is there a fix for CVE-2026-10627?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10627 attacked?

It is attacked over the network.

Am I affected by CVE-2026-10627?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10627: WordPress Events Manager authorization bypass

CVE-2026-10627 · Severity: medium · CVSS 5.3 · Published 2026-08-25

The Events Manager plugin for WordPress, used to manage calendar events, bookings, and ticket sales, contains an authorization flaw that allows unauthenticated attackers to view sensitive event details that administrators have marked as draft, pending, trashed, or private. This exposes confidential event information including titles, dates, descriptions, and locations without requiring valid login credentials.

Quick answers

Is CVE-2026-10627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10627 being exploited in the wild.
How severe is CVE-2026-10627?: Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?: Barn2 Media Events Manager up to and including 7.4.0.
Is there a fix for CVE-2026-10627?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10627 attacked?: It is attacked over the network.
Am I affected by CVE-2026-10627?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the Events Manager plugin caused by insufficient verification of user permissions before returning event details. The plugin fails to properly check whether an unauthenticated user has authorization to access non-public event statuses (draft, pending, trash, private) through its API or direct queries. An attacker can directly access event data via the plugin's classes (em-events.php, em-object.php) without authentication, retrieving metadata for unpublished or restricted events. The vulnerability affects all versions up to and including 7.4.0. A patch is required to enforce proper capability checks before exposing event information.

Affected products

Barn2 Media Events Manager up to and including 7.4.0

Timeline

2026-08-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.