CVE-2026-122087: Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Event Tickets and Registration WordPress pluginto a version that resolves this vulnerability.Fixed in 5.30.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using The Events Calendar Event Tickets and Registration plugin versions before 5.30.3.1 are exposed if they have attendee data associated with private or other non-public events.
Does exploitation require an account or special permissions?
No. The issue can be exploited by unauthenticated users through the Attendees REST API.
What information can be disclosed?
An attacker can retrieve attendee data for events that the requester would not normally be allowed to view, including private and other non-public events.
What should be done if the site cannot be patched immediately?
The provided information does not identify a temporary mitigation. Restricting unauthenticated access to the affected Attendees REST API would address the described attack path if that can be done safely in the deployment.