WordPress Plugin Vulnerabilities

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

Description

The plugin does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

Proof of Concept

Affects Plugins

Plugin icon
events-manager
Fixed in 7.4.5

References

CVE
CVE-2026-93661

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Hasyros
Submitter
Hasyros
Verified
Yes
WPVDB ID
8f1c665e-15e4-4b5d-853d-919723614611

Timeline

Publicly Published
2026-09-22 (about 2 days ago)
Added
2026-09-22 (about 1 day ago)
Last Updated
2026-09-22 (about 1 day ago)

Other

Published
Title
Published
2026-04-07
Title
Blog2Social: Social Media Auto Post & Scheduler < 8.8.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter
Published
2025-04-22
Title
WordPress Simple PayPal Shopping Cart < 5.1.3 - Unauthenticated Product Price Manipulation
Published
2024-04-05
Title
Profile Builder < 3.11.3 - Restricted Email Bypass
Published
2024-11-27
Title
Restaurant & Cafe Addon for Elementor < 1.6.0 - Authenticated (Contributor+) Post Disclosure
Published
2026-01-27
Title
Document Embedder < 2.0.5 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion