Events Manager WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure exists in the Events Manager WordPress plugin, in all versions up to and including 7.2.2.2. The issue arises from insufficient restrictions on the 'get_location' action, allowing unauthenticated attackers to access data from password-protected, private, or draft event locations that should be off-limits.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information from restricted event locations.

Remediation

Users are advised to update the Events Manager plugin to version 7.2.2.3 or a newer patched version.