# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.10 - Unauthenticated Sensitive Information Exposure via Calendar 'format' Parameter

- **ID:** WPSEC-2026-1658
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** all versions before 7.4.11
- **Fixed in:** 7.4.11 (Update to 7.4.11 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1658/

## Description

The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the calendar 'format' request parameter in all versions up to, and including, 7.4.10. This is due to the AJAX calendar handler (ajaxCalendar) accepting an arbitrary event format from the request, sanitising it only for HTML, and expanding placeholders such as #_CONTACTMETA and #_ATTENDEESLIST server-side, with #_CONTACTMETA returning any user meta key of the event owner. This makes it possible for unauthenticated attackers to read scalar user meta values of event owners, including private profile data or secrets other plugins keep in user meta, as well as event attendee lists.

## References

- https://wpsec.com/vuln/WPSEC-2026-1658/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.11/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1658/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.