{
 "id": "WPSEC-2026-3073",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3073/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3073/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3073/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Subscriber+) Sensitive Information Exposure via REST API Booking and Event Responses",
 "description": "The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API and MCP in versions 7.3 up to, and including, 7.4.13. This is due to booking responses embedding the event with its owner's email address, and event and availability responses listing hidden or restricted tickets, without checking that the reader can manage the event's bookings. This makes it possible for authenticated attackers with subscriber-level access and above to obtain event owners' email addresses and the details of tickets that are not offered to them.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.3",
    "from_inclusive": true,
    "to": "7.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.3 before 7.4.14"
  ]
 },
 "introduced_in": "7.3",
 "fixed_in": "7.4.14",
 "remediation": "Update to 7.4.14 or later.",
 "fix_released": "2026-11-12T13:30:09+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:15:44.440900+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3073/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}