CVE-2026-122061 · Package
NO FIX YET · SEE WHAT TO DO
The Event Tickets and Registration WordPress plugin returns attendee names over its REST API for events that do not publish an attendee list. An unauthenticated visitor can read those names.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Event Tickets and Registration WordPress plugin before 5.30.3.1 that host events. The exposure is through the plugin's public REST API, so sites that do not use the plugin are not affected. Whether a given event's attendee names leak depends on that event not showing a public attendee list.
Not affected if plugin-not-installed, version-5.30.3.1-or-later
Who cares event-tickets, self-hosted, wordpress
5.30.3.1.5.30.3.1 or later.The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.