[ CVE-2026-93661 · Published 24 Sep 2026 ]
Vulnerability in Unknown Events Manager
CVSS 2.7
EPSS <1%No fix listed yet
[ Description ]Official description
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.