Events Manager <= 7.4.3 - Unauthenticated Insecure Direct Object Reference to Booking Timeslot Capacity Bypass

ID

WPSEC-2026-0196

Plugin

Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)

Affected

from 7.2 before 7.4.4

Remediation

Update to 7.4.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-639

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Events Manager on WPSec AttackSurface

Fix released

2026-09-18

Published

2026-10-01

Description

The Events Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 7.2 up to, and including, 7.4.3 due to the timeslot loader fetching a user-supplied timeslot ID without verifying that it belongs to the event being booked. This makes it possible for unauthenticated attackers, where guest bookings are allowed, to submit a booking for an event using another event's timeslot ID, giving the booking that slot's dates and times and a fresh per-slot booking count that bypasses the event's capacity limits.

References

• https://wpsec.com/vuln/WPSEC-2026-0196/
• https://plugins.svn.wordpress.org/events-manager/tags/7.4.4/
• https://wordpress.org/plugins/events-manager/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS