{"id":"CVE-2026-122061","kind":"vulnerability","aliases":["CVE-2026-122061"],"related":[],"title":"Event Tickets WordPress plugin: REST API leaks attendee names without authentication","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.","summary":"The Event Tickets and Registration WordPress plugin returns attendee names over its REST API for events that do not publish an attendee list. An unauthenticated visitor can read those names.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-5.30.3.1-or-later"],"how_to_check":"- Check the installed version of the Event Tickets and Registration plugin in the WordPress admin under Plugins; affected versions are before `5.30.3.1`.","fix":"- Event Tickets and Registration plugin: move to `5.30.3.1` or later.","status":"open","published_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:26+00:00","updated_at":"2026-11-11T06:27:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:26Z","model":"claude-haiku-5-5","output":{"fix":"- Event Tickets and Registration plugin: move to `5.30.3.1` or later.","reach":"internet","title":"Event Tickets WordPress plugin: REST API leaks attendee names without authentication","impact":"low","summary":"The Event Tickets and Registration WordPress plugin returns attendee names over its REST API for events that do not publish an attendee list. An unauthenticated visitor can read those names.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","event-tickets","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attendee names readable by anyone on the internet","analyst_note":"product_name is empty because no products were listed; the plugin is named in the title.","how_to_check":"- Check the installed version of the Event Tickets and Registration plugin in the WordPress admin under Plugins; affected versions are before `5.30.3.1`.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5.30.3.1-or-later"],"who_is_affected":"Sites running the Event Tickets and Registration WordPress plugin before 5.30.3.1 that host events. The exposure is through the plugin's public REST API, so sites that do not use the plugin are not affected. Whether a given event's attendee names leak depends on that event not showing a public attendee list.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000716,"input_tokens":4542,"output_tokens":523,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122061':14A,17A '-2026':13A,16A '5.30.3.1':64C 'allow':87C 'api':6A,39B,86C 'attende':8A,34B,47B,75C,82C,95C,104C 'authent':11A 'check':68C 'correct':67C 'cve':12A,15A 'display':72C 'event':1A,19B,27B,41B,57C,71C,97C 'event-ticket':18B 'host':24B 'leak':7A 'list':48B,76C,105C 'name':9A,35B,55B,93C 'one':79C 'packag':21B 'plugin':4A,32B,62C 'public':74C,103C 'publish':45B 'read':53B 'registr':30B,60C 'rest':5A,38B,85C 'retriev':91C 'return':33B,78C 'self':23B 'self-host':22B 'show':101C 'ticket':2A,20B,28B,58C 'unauthent':50B,88C 'user':89C 'visitor':51B 'whether':69C 'without':10A 'wordpress':3A,25B,31B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets and Registration WordPress plugin before 5.30.3.1 that host events. The exposure is through the plugin's public REST API, so sites that do not use the plugin are not affected. Whether a given event's attendee names leak depends on that event not showing a public attendee list.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventtickets","low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-122061':14A,17A '-2026':13A,16A 'api':6A 'attende':8A 'authent':11A 'cve':12A,15A 'event':1A 'leak':7A 'name':9A 'plugin':4A 'rest':5A 'ticket':2A 'without':10A 'wordpress':3A","search_b":"'api':39B 'attende':34B,47B 'event':19B,27B,41B 'event-ticket':18B 'host':24B 'list':48B 'name':35B,55B 'packag':21B 'plugin':32B 'publish':45B 'read':53B 'registr':30B 'rest':38B 'return':33B 'self':23B 'self-host':22B 'ticket':20B,28B 'unauthent':50B 'visitor':51B 'wordpress':25B,31B","search_c":"'5.30.3.1':64C 'allow':87C 'api':86C 'attende':75C,82C,95C,104C 'check':68C 'correct':67C 'display':72C 'event':57C,71C,97C 'list':76C,105C 'name':93C 'one':79C 'plugin':62C 'public':74C,103C 'registr':60C 'rest':85C 'retriev':91C 'return':78C 'show':101C 'ticket':58C 'unauthent':88C 'user':89C 'whether':69C 'wordpress':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122061","severity":null,"published_at":"2026-11-11T06:17:17+00:00","modified_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}