Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Moderation Bypass via REST API Event Status
- ID
- WPSEC-2026-3067
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.3 before 7.4.14
- Remediation
- Update to 7.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to a moderation bypass via the REST API and MCP event and location saves in versions 7.3 up to, and including, 7.4.13. This is due to the plugin requiring the publish capability only for the 'publish' status, although Events Manager treats a 'private' event or location as live, and to an event that goes live publishing its attached location without checking that the user may publish that location. This makes it possible for authenticated attackers with contributor-level access and above to make their events visible to logged-in users without moderator approval, and to publish unpublished locations attached to them, including other users' locations.
References
- https://wpsec.com/vuln/WPSEC-2026-3067/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS