Vulnerabilities / Events Manager – Calendar, Bookings, Tickets, Appointments and more! / WPSEC-2026-3074
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Unauthenticated Content Restriction Bypass via Event Preview
Low 3.7
CWE-284Fixed in 7.4.14
- ID
- WPSEC-2026-3074
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- all versions before 7.4.14
- Remediation
- Update to 7.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-284
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to a content restriction bypass in all versions up to, and including, 7.4.13 due to the event content filter outputting the raw event content for any request in preview mode, without checking that the visitor can edit the event. This makes it possible for unauthenticated attackers to read event content that another plugin, such as a membership plugin, restricts through the content filter.
References
- https://wpsec.com/vuln/WPSEC-2026-3074/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS