Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - OAuth Scope Restriction Bypass via XML-RPC
- ID
- WPSEC-2026-1657
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.11
- Remediation
- Update to 7.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-26
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to an authorization bypass in its OAuth application password integration in all versions up to, and including, 7.4.10. This is due to route scope restrictions only being enforced on REST API requests, while WordPress also accepts application passwords over XML-RPC and other non-REST surfaces where no scope check ran. This makes it possible for a holder of an OAuth credential that a user approved only for limited Events Manager access to act with that user's full capabilities, which can include administrative actions if the granting account is privileged.
References
- https://wpsec.com/vuln/WPSEC-2026-1657/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS