{
 "id": "WPSEC-2026-2638",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2638/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2638/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2638/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.12 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Bookings Count",
 "description": "The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API bookings listing in versions 7.4.4 up to, and including, 7.4.12. This is due to the listing setting 'owner' to false for every user with the manage_bookings capability, including users who cannot manage other users' bookings. The returned items were filtered, but the total count and the 'search' LIKE matching (which also did not escape wildcards) covered bookings across the whole site. This makes it possible for authenticated attackers, with Contributor-level access and above, to infer other users' attendee details, such as names and email addresses, one character at a time from the match counts.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.4.4",
    "from_inclusive": true,
    "to": "7.4.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.4.4 before 7.4.13"
  ]
 },
 "introduced_in": "7.4.4",
 "fixed_in": "7.4.13",
 "remediation": "Update to 7.4.13 or later.",
 "fix_released": "2026-11-05T08:02:10+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T11:59:15.953314+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2638/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.13/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-06"
 }
}