Wordpress Event Koi Lite <= 1.3.13.1 Unauthenticated Sensitive Information Exposure via REST API (CVE-2026-10029)

Vulnerability Overview Vulnerability Name: Event Koi Lite <= 1.3.13.1 - Missing Authorization Leading to Unauthenticated Sensitive Information Exposure via REST API Endpoints CVE ID: CVE-2026-10029 CVSS Score: 5.3 (Medium) Release Date: June 17, 2026 Last Updated: June 18, 2026 Researcher: Umut Can Yurdakul Impact Scope Software Type: Plugin Software Name: Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets Affected Versions: <= 1.3.13.1 Vulnerability Description: The Event Koi Lite plugin versions 1.3.13.1 and earlier contain a sensitive information exposure vulnerability. Attackers can extract sensitive data via unauthenticated REST API endpoints, including virtual meeting URLs, physical location data, latitude/longitude coordinates, Google Maps links, and RSVP configurations. This data was previously only visible to Draft, Pending Review, and Private events. Remediation Fixed Version: 1.3.14.0 or later Recommended Action: Update to version 1.3.14.0 or later to resolve this vulnerability. Additional Information References: Multiple links to plugins.trac.wordpress.org Sharing Options: Facebook, Twitter, LinkedIn, and Email sharing buttons provided Copyright Information Copyright: 2012-2026 Defiant Inc. License: Used under Defiant’s license terms Contact Information Technical Support: 24/7 support, 365 days a year, with a 1-hour response time Business Hours: 9am–6pm ET, 6am–5pm PT, and 2pm–1am UTC/GMT (excluding weekends and holidays) Footer Information Services: Terms of Service, Privacy Policy, and Notice of Collection Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe: Subscribe to newsletters and updates Summary This vulnerability involves a sensitive information exposure issue in the Event Koi Lite plugin. Users are advised to update to version 1.3.14.0 or later as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Wordpress Event Koi Lite <= 1.3.13.1 Unauthenticated Sensitive Information Exposure via REST API (CVE-2026-10029)

More from this source