Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Missing Authorization to Booking Availability Override via REST API
- ID
- WPSEC-2026-3071
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.3 before 7.4.14
- Remediation
- Update to 7.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to unauthorized booking changes through the REST API and MCP booking save in versions 7.3 up to, and including, 7.4.13. This is due to the availability override being granted on the site-wide manage_bookings capability instead of booking management rights on the target event, and to admin-only booking fields being kept on new bookings because the check relied on the unsaved booking's can_manage() method, which always returns true. This makes it possible for authenticated attackers with contributor-level access and above, who hold manage_bookings by default, to create bookings that override ticket availability and capacity limits on events they do not own.
References
- https://wpsec.com/vuln/WPSEC-2026-3071/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS