{
 "id": "WPSEC-2026-3074",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3074/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3074/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3074/index.md",
 "title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.13 - Unauthenticated Content Restriction Bypass via Event Preview",
 "description": "The Events Manager plugin for WordPress is vulnerable to a content restriction bypass in all versions up to, and including, 7.4.13 due to the event content filter outputting the raw event content for any request in preview mode, without checking that the visitor can edit the event. This makes it possible for unauthenticated attackers to read event content that another plugin, such as a membership plugin, restricts through the content filter.",
 "plugin": {
  "slug": "events-manager",
  "name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
  "wordpress_org": "https://wordpress.org/plugins/events-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.4.14"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.4.14",
 "remediation": "Update to 7.4.14 or later.",
 "fix_released": "2026-11-12T13:30:09+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:15:44.440900+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3074/",
  "https://plugins.svn.wordpress.org/events-manager/tags/7.4.14/",
  "https://wordpress.org/plugins/events-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}