{
 "id": "WPSEC-2026-1657",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1657/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1657/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1657/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - OAuth Scope Restriction Bypass via XML-RPC",
 "description": "The Events Manager plugin for WordPress is vulnerable to an authorization bypass in its OAuth application password integration in all versions up to, and including, 7.4.10. This is due to route scope restrictions only being enforced on REST API requests, while WordPress also accepts application passwords over XML-RPC and other non-REST surfaces where no scope check ran. This makes it possible for a holder of an OAuth credential that a user approved only for limited Events Manager access to act with that user's full capabilities, which can include administrative actions if the granting account is privileged.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.4.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.4.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.4.11",
 "remediation": "Update to 7.4.11 or later.",
 "fix_released": "2026-10-25T09:02:04+00:00",
 "published": "2026-10-26T09:43:52+00:00",
 "updated": "2026-10-25T10:58:04.391351+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1657/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-26"
 }
}