# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - OAuth Scope Restriction Bypass via XML-RPC

- **ID:** WPSEC-2026-1657
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** all versions before 7.4.11
- **Fixed in:** 7.4.11 (Update to 7.4.11 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1657/

## Description

The Events Manager plugin for WordPress is vulnerable to an authorization bypass in its OAuth application password integration in all versions up to, and including, 7.4.10. This is due to route scope restrictions only being enforced on REST API requests, while WordPress also accepts application passwords over XML-RPC and other non-REST surfaces where no scope check ran. This makes it possible for a holder of an OAuth credential that a user approved only for limited Events Manager access to act with that user's full capabilities, which can include administrative actions if the granting account is privileged.

## References

- https://wpsec.com/vuln/WPSEC-2026-1657/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1657/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.