Vulnerabilities / Events Manager – Calendar, Bookings, Tickets, Appointments and more! / WPSEC-2026-3068
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Unauthenticated Missing Authorization to Booking Private or Password-Protected Events
Medium 6.5
CWE-862Fixed in 7.4.14
- ID
- WPSEC-2026-3068
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.14
- Remediation
- Update to 7.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 7.4.13 due to the booking add action and the booking form AJAX handler not checking that the visitor can view the event, while the booking nonce is the same for every event and is available on any public event. This makes it possible for unauthenticated attackers to load the booking form for, and submit bookings on, private or password-protected events they are not allowed to view, when guest bookings are enabled (the default).
References
- https://wpsec.com/vuln/WPSEC-2026-3068/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS