CVE-2026-93661

LowCVSS 2.7

Published: 24/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

Risk Assessment

A user with ticket management permissions can take control of tickets from other events, potentially leading to unauthorized access or disruptions in ticket sales.

Recommendation

Update the Events Manager plugin to version 7.4.5 or later.

Other vulnerabilities in Events Manager WordPress Plugin

CVE-2026-18050High
The Events Manager WordPress plugin before version 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS