Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-122087 EUVD-2026-123192GHSA-4xp7-hp3g-mfgm

Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API

Published Nov 11, 2026 · Updated Nov 11, 2026 · Assigned by WPScan

Category: Web / CMS

Description

The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.

Affected products

VendorProductAffectedFixed
— Event Tickets and Registration < 5.30.3.1 5.30.3.1

References