# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Unauthenticated Missing Authorization to Booking Private or Password-Protected Events

- **ID:** WPSEC-2026-3068
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** all versions before 7.4.14
- **Fixed in:** 7.4.14 (Update to 7.4.14 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3068/

## Description

The Events Manager plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 7.4.13 due to the booking add action and the booking form AJAX handler not checking that the visitor can view the event, while the booking nonce is the same for every event and is available on any public event. This makes it possible for unauthenticated attackers to load the booking form for, and submit bookings on, private or password-protected events they are not allowed to view, when guest bookings are enabled (the default).

## References

- https://wpsec.com/vuln/WPSEC-2026-3068/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3068/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.