CVE-2026-10029: Event Koi Lite WordPress Plugin Unauthorized Event Data Exposure

Technical summary

CVE-2026-10029 is a sensitive information disclosure vulnerability in Event Koi Lite – Events Calendar (WordPress plugin) caused by insufficient access controls on the get_events endpoint. The vulnerability enables unauthenticated attackers to bypass visibility restrictions and retrieve event metadata including virtual meeting URLs, physical location coordinates (latitude/longitude), Google Maps links, and RSVP configuration from events marked as draft, pending, or private. The root cause maps to CWE-862 (Missing Authorization), indicating that authorization checks are either absent or improperly enforced before returning event data.

Business impact

Organizations using Event Koi Lite to manage private or confidential events face uncontrolled disclosure of event logistics. Private venue addresses, meeting URLs, and participant configurations could be exposed to competitors, bad actors, or the general public. For companies managing internal events, executive meetings, or customer-only gatherings, this leakage undermines privacy and operational security. The impact is heightened if events contain sensitive information such as security details, restricted attendee lists, or confidential scheduling.

Affected systems

All versions of the Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets WordPress plugin up to and including version 1.3.13.1 are vulnerable. Any WordPress installation with this plugin active is at risk, regardless of the number of private or draft events configured. The vulnerability is network-accessible and requires no authentication or special privileges to exploit.

Exploitability

This vulnerability has low complexity and requires no user interaction or authentication. An attacker can craft direct requests to the get_events function from any network location to enumerate and extract event data. The attack surface is large because no login is needed, and the endpoint is likely accessible to anyone who can reach the WordPress installation. However, practical exploitation requires knowledge of the plugin's API or discovery of the vulnerable endpoint, which may limit opportunistic attacks unless proof-of-concept tooling becomes public.

Remediation

Update the Event Koi Lite plugin to a patched version released after version 1.3.13.1. Verify the patch against the official plugin repository or vendor advisory to confirm the version addresses CWE-862 authorization bypass. As an interim control, restrict network access to the WordPress installation using firewall rules, Web Application Firewall (WAF) policies, or IP allowlisting if the events calendar is for internal or trusted use only.

Patch guidance

Check the Event Koi Lite plugin's official changelog and security advisories for a version release that addresses this vulnerability. Apply the update via the WordPress admin dashboard (Plugins > Installed Plugins > Update) once a patched version is available. Test the update in a staging environment to ensure private and draft event endpoints remain protected before deploying to production. Document the patch version applied for compliance and audit records.

Detection guidance

Monitor web server access logs for requests to the get_events endpoint from unexpected or public IP addresses. Implement logging for failed authorization attempts on sensitive endpoints. Use WordPress security plugins or SIEM solutions to alert on suspicious patterns of event data retrieval, especially if queries reference private, draft, or pending event identifiers. Additionally, periodically audit the plugin's version and confirm it is updated to the latest patched release.

Why prioritize this

Although the CVSS score of 5.3 (MEDIUM) reflects limited confidentiality impact with no integrity or availability consequences, the vulnerability affects all users of a popular WordPress plugin and requires zero authentication. Unauthorized exposure of event details, especially for organizations managing restricted-access meetings or secure events, poses a reputational and operational risk. Priority should be elevated if your organization uses Event Koi Lite for sensitive internal or client events; lower priority if the plugin manages only public-facing calendar content.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability with low attack complexity, no authentication required, and a local impact scope. Confidentiality is rated as partial loss (L), as the exposure is limited to event metadata rather than all site data. Integrity and availability are unaffected. The medium severity rating appropriately captures the risk of uncontrolled information leakage without critical system compromise. Organizations managing high-sensitivity events should consider raising their internal risk rating above the base CVSS.

Frequently asked questions