# CVE-2026-122087: Event Tickets and Registration information disclosure in attendee REST API

Source: https://junglewise.ai/threats/cve-2026-122087-the-event-tickets-and-registration-wordpress-plugin-before-5-30  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-122087 · Severity: info · Published 2026-11-11

The Event Tickets and Registration WordPress plugin allows unauthenticated attackers to retrieve a list of attendees for private and non-public events through an improperly restricted REST API endpoint. An attacker can discover who is registered for confidential or restricted events, exposing sensitive personal information without authorization.

Technologies: [The Events Calendar Event Tickets and Registration](https://junglewise.ai/threats/technologies/event-tickets-and-registration). Vendors: [The Events Calendar](https://junglewise.ai/threats/vendors/the-events-calendar).

## Quick answers

**Is CVE-2026-122087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122087 being exploited in the wild.

**How severe is CVE-2026-122087?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** The Events Calendar Event Tickets and Registration before 5.30.3.1.

**Is there a fix for CVE-2026-122087?** Yes: fixed in 5.30.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122087 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-122087?** Check whether you run The Events Calendar Event Tickets and Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.30.3.1

## Technical details

The plugin's attendees REST API endpoint does not properly filter results based on the visibility of the associated event, allowing a post_status filter bypass. Unauthenticated users can query the REST API to enumerate attendee data for private or otherwise non-public events, gaining unauthorized access to personally identifiable information tied to event registrations.

## Affected products

- The Events Calendar Event Tickets and Registration before 5.30.3.1

## Timeline

- 2026-11-09: disclosed
- 2026-11-11: advisory

## References

- [https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-f8449fd4125b/](https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-f8449fd4125b/)

## Related threats

- [Event Tickets and Registration information disclosure via REST API](https://junglewise.ai/threats/cve-2026-122061-the-event-tickets-and-registration-wordpress-plugin-before-5-30)
- [Event Tickets and Registration Stripe OAuth endpoint capability check bypass](https://junglewise.ai/threats/cve-2026-3174-event-tickets-and-registration-stripe-oauth-endpoint-capability)
- [Event Tickets and Registration IDOR in seating actions](https://junglewise.ai/threats/cve-2026-14823-event-tickets-and-registration-idor-in-seating-actions)
- [The Events Calendar Event Tickets stored XSS in ticket history log](https://junglewise.ai/threats/cve-2026-14819-the-events-calendar-event-tickets-stored-xss-in-ticket-history)