Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Missing Authorization to Media Upload and Attachment Modification via REST API Featured Image
- ID
- WPSEC-2026-3072
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.3.3 before 7.4.14
- Remediation
- Update to 7.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to unauthorized media changes via the featured image input of the REST API and MCP event and location saves in versions 7.3.3 up to, and including, 7.4.13. This is due to this input creating Media Library attachments without the upload_files capability check the media endpoint applies, accepting a caller-supplied parent post, and writing the alt text of any attachment ID given. This makes it possible for authenticated attackers with contributor-level access and above to upload media without the upload_files capability, attach media to posts they cannot edit, and overwrite the alt text of other users' images.
References
- https://wpsec.com/vuln/WPSEC-2026-3072/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS