Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Unauthenticated Clickjacking to OAuth Application Authorization
- ID
- WPSEC-2026-0819
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.3 before 7.4.8
- Remediation
- Update to 7.4.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weakness
- CWE-1021
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Clickjacking via the OAuth authorization consent screen in versions 7.3 up to, and including, 7.4.7. This is due to the front-end consent page not sending anti-framing headers (X-Frame-Options or a frame-ancestors policy), combined with OAuth-issued application passwords not being restricted to their granted scope. This makes it possible for unauthenticated attackers, who can register their own client through the open registration endpoint, to trick a logged-in user such as an administrator into approving that client in a framed page, obtaining an application password that can call any REST route available to that user.
References
- https://wpsec.com/vuln/WPSEC-2026-0819/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.8/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS