# Event Tickets and Registration <= 5.30.3 - Unauthenticated Sensitive Information Exposure via REST API Attendee Listings

- **ID:** WPSEC-2026-2438
- **Plugin:** Event Tickets and Registration (`event-tickets`), https://wordpress.org/plugins/event-tickets/
- **Affected versions:** from 4.8 before 5.30.3.1
- **Fixed in:** 5.30.3.1 (Update to 5.30.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/event-tickets
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2438/

## Description

The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API attendee endpoints in all versions up to, and including, 5.30.3, due to insufficient visibility checks. The single-attendee endpoint read the '_tribe_hide_attendees_list' meta with inverted logic, which this plugin stores as 1 when the attendee list is shown. As a result it served attendees of events that do not display a public attendee list, which is the default. The attendee archive also did not exclude attendees of password-protected posts. This makes it possible for unauthenticated attackers to view attendee information for events whose attendee lists are hidden or password-protected.

## References

- https://wpsec.com/vuln/WPSEC-2026-2438/
- https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3.1/
- https://wordpress.org/plugins/event-tickets/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2438/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.