# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Contributor+) Missing Authorization to Media Upload and Attachment Modification via REST API Featured Image

- **ID:** WPSEC-2026-3072
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** from 7.3.3 before 7.4.14
- **Fixed in:** 7.4.14 (Update to 7.4.14 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3072/

## Description

The Events Manager plugin for WordPress is vulnerable to unauthorized media changes via the featured image input of the REST API and MCP event and location saves in versions 7.3.3 up to, and including, 7.4.13. This is due to this input creating Media Library attachments without the upload_files capability check the media endpoint applies, accepting a caller-supplied parent post, and writing the alt text of any attachment ID given. This makes it possible for authenticated attackers with contributor-level access and above to upload media without the upload_files capability, attach media to posts they cannot edit, and overwrite the alt text of other users' images.

## References

- https://wpsec.com/vuln/WPSEC-2026-3072/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3072/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.