{
 "id": "WPSEC-2026-3072",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3072/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3072/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3072/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Missing Authorization to Media Upload and Attachment Modification via REST API Featured Image",
 "description": "The Events Manager plugin for WordPress is vulnerable to unauthorized media changes via the featured image input of the REST API and MCP event and location saves in versions 7.3.3 up to, and including, 7.4.13. This is due to this input creating Media Library attachments without the upload_files capability check the media endpoint applies, accepting a caller-supplied parent post, and writing the alt text of any attachment ID given. This makes it possible for authenticated attackers with contributor-level access and above to upload media without the upload_files capability, attach media to posts they cannot edit, and overwrite the alt text of other users' images.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.3.3",
    "from_inclusive": true,
    "to": "7.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.3.3 before 7.4.14"
  ]
 },
 "introduced_in": "7.3.3",
 "fixed_in": "7.4.14",
 "remediation": "Update to 7.4.14 or later.",
 "fix_released": "2026-11-12T13:30:09+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:15:44.440900+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3072/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}