CVE-2026-122061: Event Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST Endpoint
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Event Tickets and Registration WordPress plugin with a version earlier than 5.30.3.1 are exposed. The issue affects attendee names for events configured not to display a public attendee list.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They can use the single-attendee REST API endpoint to retrieve attendee names.
How can I determine whether my site is affected?
Check whether the installed plugin version is earlier than 5.30.3.1 and whether events have attendee lists that are not intended to be public. Affected sites may expose individual attendee names through the REST API despite those event settings.