# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.12 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Bookings Count

- **ID:** WPSEC-2026-2638
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** from 7.4.4 before 7.4.13
- **Fixed in:** 7.4.13 (Update to 7.4.13 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2638/

## Description

The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API bookings listing in versions 7.4.4 up to, and including, 7.4.12. This is due to the listing setting 'owner' to false for every user with the manage_bookings capability, including users who cannot manage other users' bookings. The returned items were filtered, but the total count and the 'search' LIKE matching (which also did not escape wildcards) covered bookings across the whole site. This makes it possible for authenticated attackers, with Contributor-level access and above, to infer other users' attendee details, such as names and email addresses, one character at a time from the match counts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2638/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.13/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2638/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.