CVE-2026-109994 · Package
NO FIX YET
The Eventin events and booking plugin for WordPress exposes the email address and phone number of any user, including administrators, through its 'id' parameter in all versions up to and including 4.1.29. An attacker with a basic subscriber account can read those contact details for any account.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Eventin plugin up to and including 4.1.29 that allow subscriber-level accounts, such as sites with open registration. The flaw needs a logged-in account, so sites that disable public registration and have no other user accounts are less exposed. The sources do not say which endpoint or which setting is involved.
Not affected if no-subscriber-accounts, plugin-not-installed
Who cares eventin, woocommerce, wordpress
wp plugin get eventin --field=version with WP-CLI.4.1.29 or earlier as exposed.No fix yet, per the sources.
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email address and phone number of any WordPress user, including administrators, by supplying their user id in a query-string parameter while placing the authenticated user's own id in the URL path.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.