# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Moderation Bypass via REST API Event Status

- **ID:** WPSEC-2026-3067
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** from 7.3 before 7.4.14
- **Fixed in:** 7.4.14 (Update to 7.4.14 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3067/

## Description

The Events Manager plugin for WordPress is vulnerable to a moderation bypass via the REST API and MCP event and location saves in versions 7.3 up to, and including, 7.4.13. This is due to the plugin requiring the publish capability only for the 'publish' status, although Events Manager treats a 'private' event or location as live, and to an event that goes live publishing its attached location without checking that the user may publish that location. This makes it possible for authenticated attackers with contributor-level access and above to make their events visible to logged-in users without moderator approval, and to publish unpublished locations attached to them, including other users' locations.

## References

- https://wpsec.com/vuln/WPSEC-2026-3067/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3067/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.