Is CVE-2026-109994 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109994 being exploited in the wild.

How severe is CVE-2026-109994?

Medium severity, with a CVSS score of 6.5, published 6 November 2026.

Which products and versions are affected?

Eventin Events Calendar, Tickets, Registration, Booking & WooCommerce up to and including 4.1.29.

Is there a fix for CVE-2026-109994?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Am I affected by CVE-2026-109994?

Check whether you run Eventin Events Calendar, Tickets, Registration or Booking & WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109994: Eventin Events Calendar sensitive information exposure in user profile endpoint

CVE-2026-109994 · Severity: medium · CVSS 6.5 · Published 2026-11-06

Eventin is a WordPress plugin for managing events, tickets, and registrations. Attackers with a low-level subscriber account can extract email addresses and phone numbers of any WordPress user, including administrators, by exploiting a flaw in how the plugin handles user ID parameters. This exposes sensitive contact information that could be used for targeted attacks or social engineering.

Vendors: Eventin.

Quick answers

Is CVE-2026-109994 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109994 being exploited in the wild.
How severe is CVE-2026-109994?: Medium severity, with a CVSS score of 6.5, published 6 November 2026.
Which products and versions are affected?: Eventin Events Calendar, Tickets, Registration, Booking & WooCommerce up to and including 4.1.29.
Is there a fix for CVE-2026-109994?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109994 attacked?: It is in a web application.
Am I affected by CVE-2026-109994?: Check whether you run Eventin Events Calendar, Tickets, Registration or Booking & WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly validate the 'id' parameter in a user profile or data retrieval endpoint, allowing authenticated subscribers to request data for arbitrary user IDs rather than their own. By manipulating the query parameter while authenticating as a low-privilege user, an attacker can bypass ownership checks and retrieve private email addresses and phone numbers. This is an information disclosure vulnerability requiring authentication but no additional user interaction.

Affected products

Eventin Events Calendar, Tickets, Registration, Booking & WooCommerce up to and including 4.1.29

Timeline

2026-11-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.