Vulnerabilities / Events Manager – Calendar, Bookings, Tickets, Appointments and more! / WPSEC-2026-3073
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Subscriber+) Sensitive Information Exposure via REST API Booking and Event Responses
Medium 4.3
CWE-200Fixed in 7.4.14
- ID
- WPSEC-2026-3073
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.3 before 7.4.14
- Remediation
- Update to 7.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API and MCP in versions 7.3 up to, and including, 7.4.13. This is due to booking responses embedding the event with its owner's email address, and event and availability responses listing hidden or restricted tickets, without checking that the reader can manage the event's bookings. This makes it possible for authenticated attackers with subscriber-level access and above to obtain event owners' email addresses and the details of tickets that are not offered to them.
References
- https://wpsec.com/vuln/WPSEC-2026-3073/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS