Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.12 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Bookings Count
- ID
- WPSEC-2026-2638
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.4.4 before 7.4.13
- Remediation
- Update to 7.4.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API bookings listing in versions 7.4.4 up to, and including, 7.4.12. This is due to the listing setting 'owner' to false for every user with the manage_bookings capability, including users who cannot manage other users' bookings. The returned items were filtered, but the total count and the 'search' LIKE matching (which also did not escape wildcards) covered bookings across the whole site. This makes it possible for authenticated attackers, with Contributor-level access and above, to infer other users' attendee details, such as names and email addresses, one character at a time from the match counts.
References
- https://wpsec.com/vuln/WPSEC-2026-2638/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.13/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS