low2.7
CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, …
Impact
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
Affected products
| Product | Affected versions |
|---|---|
| Events Manager WordPress Plugin | before 7.4.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.