Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Booking Approval Bypass and Authenticated (Subscriber+) Arbitrary Booking Cancellation via 'booking_id' Parameter Mass Assignment
- ID
- WPSEC-2026-1442
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.9
- Remediation
- Update to 7.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-915
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to improperly controlled modification of object attributes via the 'booking_id' parameter in all versions up to, and including, 7.4.8. This is due to the booking action handlers passing the raw request value to em_get_booking() without checking that it is a numeric ID or a booking UUID. When an array is supplied, its keys are assigned to the database fields of a booking object, such as the booking's ID, event, owner and status, and the permission checks then run against these supplied values instead of the stored booking. This makes it possible for unauthenticated attackers, when guest bookings are enabled (the default), to create bookings that are already approved, bypassing manual booking approval; for authenticated attackers with subscriber-level access and above to cancel other users' bookings when booking cancellation is enabled (the default); and for authenticated attackers with contributor-level access and above, who can manage bookings by default, to approve, reject or delete any booking on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-1442/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.9/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS