Executive brief
The Events Manager plugin for WordPress, used to manage calendar events, bookings, and ticket sales, contains an authorization flaw that allows unauthenticated attackers to view sensitive event details that administrators have marked as draft, pending, trashed, or private. This exposes confidential event information including titles, dates, descriptions, and locations without requiring valid login credentials.
Technical details
The vulnerability is an authorization bypass in the Events Manager plugin caused by insufficient verification of user permissions before returning event details. The plugin fails to properly check whether an unauthenticated user has authorization to access non-public event statuses (draft, pending, trash, private) through its API or direct queries. An attacker can directly access event data via the plugin's classes (em-events.php, em-object.php) without authentication, retrieving metadata for unpublished or restricted events. The vulnerability affects all versions up to and including 7.4.0. A patch is required to enforce proper capability checks before exposing event information.
Affected products
- Barn2 Media Events Manager up to and including 7.4.0
Timeline
- 2026-08-25: disclosed