CVE-2026-93661: Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Events Manager WordPress pluginto a version that resolves this vulnerability.Fixed in 7.4.5
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can manage tickets for at least one event can exploit it. The issue allows that user to overwrite and reassign tickets belonging to other events on the same site.
What access does an attacker need?
The attacker needs an account with permission to manage an event's tickets. The vulnerability is described as affecting Contributor-level users and above when they have that ticket-management capability.
Which versions are affected?
Events Manager versions before 7.4.5 are affected. Updating to version 7.4.5 or later addresses the described issue.