{
 "id": "WPSEC-2026-1658",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1658/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1658/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1658/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - Unauthenticated Sensitive Information Exposure via Calendar 'format' Parameter",
 "description": "The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the calendar 'format' request parameter in all versions up to, and including, 7.4.10. This is due to the AJAX calendar handler (ajaxCalendar) accepting an arbitrary event format from the request, sanitising it only for HTML, and expanding placeholders such as #_CONTACTMETA and #_ATTENDEESLIST server-side, with #_CONTACTMETA returning any user meta key of the event owner. This makes it possible for unauthenticated attackers to read scalar user meta values of event owners, including private profile data or secrets other plugins keep in user meta, as well as event attendee lists.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.4.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.4.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.4.11",
 "remediation": "Update to 7.4.11 or later.",
 "fix_released": "2026-10-25T09:02:04+00:00",
 "published": "2026-10-26T09:43:52+00:00",
 "updated": "2026-10-25T10:58:04.391351+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1658/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-26"
 }
}