OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-93661

LOW · CVSS 2.7 EPSS 0.17%

Source: NVD + CISA KEV + EPSS · Published 2026-09-24 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Events Manager plugin for WordPress prior to version 7.4.5 is vulnerable to unauthorized ticket reassignment, allowing users with ticket management permissions to overwrite ticket identifiers and redirect them to their own events. This could lead to potential misuse of event tickets and unauthorized access to event management functionalities. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

CVE
CVE-2026-93661
Severity
LOW
CVSS
2.7
EPSS
0.17%
WordPress

Original NVD Description

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.