Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - Unauthenticated Sensitive Information Exposure via 'event_status' and 'location_status' Parameters
- ID
- WPSEC-2026-1656
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.11
- Remediation
- Update to 7.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-26
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'event_status' and 'location_status' search parameters in all versions up to, and including, 7.4.10. This is due to faulty logic in EM_Object::build_sql_conditions() that applies the request's event_status (for event queries) or location_status (for location queries) value to the main status condition, which skips the clamp that limits the 'status' argument to published items for visitors. This makes it possible for unauthenticated attackers to list draft, pending and trashed events and locations, with their details, through the public AJAX calendar, map and search requests.
References
- https://wpsec.com/vuln/WPSEC-2026-1656/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS