# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Missing Authorization to Booking Availability Override via REST API

- **ID:** WPSEC-2026-3071
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** from 7.3 before 7.4.14
- **Fixed in:** 7.4.14 (Update to 7.4.14 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3071/

## Description

The Events Manager plugin for WordPress is vulnerable to unauthorized booking changes through the REST API and MCP booking save in versions 7.3 up to, and including, 7.4.13. This is due to the availability override being granted on the site-wide manage_bookings capability instead of booking management rights on the target event, and to admin-only booking fields being kept on new bookings because the check relied on the unsaved booking's can_manage() method, which always returns true. This makes it possible for authenticated attackers with contributor-level access and above, who hold manage_bookings by default, to create bookings that override ticket availability and capacity limits on events they do not own.

## References

- https://wpsec.com/vuln/WPSEC-2026-3071/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3071/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.