# Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Authenticated (Subscriber+) Sensitive Information Exposure via REST API Booking and Event Responses

- **ID:** WPSEC-2026-3073
- **Plugin:** Events Manager – Calendar, Bookings, Tickets, Appointments and more! (`events-manager`), https://wordpress.org/plugins/events-manager/
- **Affected versions:** from 7.3 before 7.4.14
- **Fixed in:** 7.4.14 (Update to 7.4.14 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3073/

## Description

The Events Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API and MCP in versions 7.3 up to, and including, 7.4.13. This is due to booking responses embedding the event with its owner's email address, and event and availability responses listing hidden or restricted tickets, without checking that the reader can manage the event's bookings. This makes it possible for authenticated attackers with subscriber-level access and above to obtain event owners' email addresses and the details of tickets that are not offered to them.

## References

- https://wpsec.com/vuln/WPSEC-2026-3073/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3073/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.