Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - Unauthenticated Sensitive Information Exposure via Calendar 'format' Parameter
- ID
- WPSEC-2026-1658
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.11
- Remediation
- Update to 7.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-26
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the calendar 'format' request parameter in all versions up to, and including, 7.4.10. This is due to the AJAX calendar handler (ajaxCalendar) accepting an arbitrary event format from the request, sanitising it only for HTML, and expanding placeholders such as #_CONTACTMETA and #_ATTENDEESLIST server-side, with #_CONTACTMETA returning any user meta key of the event owner. This makes it possible for unauthenticated attackers to read scalar user meta values of event owners, including private profile data or secrets other plugins keep in user meta, as well as event attendee lists.
References
- https://wpsec.com/vuln/WPSEC-2026-1658/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS