# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.7 - Unauthenticated Clickjacking to OAuth Application Authorization

- **ID:** WPSEC-2026-0819
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** from 7.3 before 7.4.8
- **Fixed in:** 7.4.8 (Update to 7.4.8 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-1021
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0819/

## Description

The Events Manager plugin for WordPress is vulnerable to Clickjacking via the OAuth authorization consent screen in versions 7.3 up to, and including, 7.4.7. This is due to the front-end consent page not sending anti-framing headers (X-Frame-Options or a frame-ancestors policy), combined with OAuth-issued application passwords not being restricted to their granted scope. This makes it possible for unauthenticated attackers, who can register their own client through the open registration endpoint, to trick a logged-in user such as an administrator into approving that client in a framed page, obtaining an application password that can call any REST route available to that user.

## References

- https://wpsec.com/vuln/WPSEC-2026-0819/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.8/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0819/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.