Events Manager <= 7.4.3 - Unauthenticated User Interface Misrepresentation via 'client_name' Parameter on OAuth Consent Screen
- ID
- WPSEC-2026-0197
- Plugin
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! (events-manager)
- Affected
- from 7.3.3 before 7.4.4
- Remediation
- Update to 7.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-451
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Events Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Events Manager plugin for WordPress is vulnerable to User Interface Misrepresentation in versions 7.3.3 up to, and including, 7.4.3. The bundled OAuth authorization consent screen displayed an application name taken from the request's 'client_name' parameter, did not show where the issued credential would be sent, and did not indicate that the client had registered itself through the open dynamic client registration endpoint. This makes it possible for unauthenticated attackers to register a client and send a logged-in user a consent link that shows an arbitrary, trusted-looking application name on the site's own domain; if the user approves, the authorization code goes to the attacker's redirect URI and can be exchanged for an application password for that user's account.
References
- https://wpsec.com/vuln/WPSEC-2026-0197/
- https://plugins.svn.wordpress.org/events-manager/tags/7.4.4/
- https://wordpress.org/plugins/events-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS