# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - Unauthenticated Sensitive Information Exposure via 'event_status' and 'location_status' Parameters

- **ID:** WPSEC-2026-1656
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** all versions before 7.4.11
- **Fixed in:** 7.4.11 (Update to 7.4.11 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1656/

## Description

The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'event_status' and 'location_status' search parameters in all versions up to, and including, 7.4.10. This is due to faulty logic in EM_Object::build_sql_conditions() that applies the request's event_status (for event queries) or location_status (for location queries) value to the main status condition, which skips the clamp that limits the 'status' argument to published items for visitors. This makes it possible for unauthenticated attackers to list draft, pending and trashed events and locations, with their details, through the public AJAX calendar, map and search requests.

## References

- https://wpsec.com/vuln/WPSEC-2026-1656/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1656/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.