CyberRota Analysis
AI-GeneratedThe Events Manager plugin for WordPress prior to version 7.4 lacks proper authorization checks on a REST route for temporarily stored file uploads, enabling unauthenticated users to access another user's in-progress uploads if they possess the temporary identifier. This vulnerability could lead to unauthorized data exposure, particularly sensitive files, during the upload process. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential risks.
Original NVD Description
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.