{
 "id": "WPSEC-2026-3068",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3068/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3068/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3068/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Unauthenticated Missing Authorization to Booking Private or Password-Protected Events",
 "description": "The Events Manager plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 7.4.13 due to the booking add action and the booking form AJAX handler not checking that the visitor can view the event, while the booking nonce is the same for every event and is available on any public event. This makes it possible for unauthenticated attackers to load the booking form for, and submit bookings on, private or password-protected events they are not allowed to view, when guest bookings are enabled (the default).",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.4.14"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.4.14",
 "remediation": "Update to 7.4.14 or later.",
 "fix_released": "2026-11-12T13:30:09+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:15:44.440900+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3068/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}