{
 "id": "WPSEC-2026-3069",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3069/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3069/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3069/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Unauthenticated Sensitive Information Exposure via Abilities API",
 "description": "The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the abilities API in all versions up to, and including, 7.4.13 due to data abilities being registered with a default permission callback that always returns true. This makes it possible for unauthenticated attackers to invoke data abilities that do not define their own permission callback and retrieve Events Manager data intended only for logged-in users.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.3",
    "from_inclusive": true,
    "to": "7.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.3 before 7.4.14"
  ]
 },
 "introduced_in": "7.3",
 "fixed_in": "7.4.14",
 "remediation": "Update to 7.4.14 or later.",
 "fix_released": "2026-11-12T13:30:09+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:15:44.440900+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3069/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}