---
id: "CVE-2026-122061"
page: "https://infrastack.ai/live/CVE-2026-122061"
kind: "vulnerability"
aliases: ["CVE-2026-122061"]
title: "Event Tickets WordPress plugin: REST API leaks attendee names without authentication"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["event-tickets", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-5.30.3.1-or-later"]
published_at: "2026-11-11T06:17:17+00:00"
first_seen_at: "2026-11-11T06:25:42+00:00"
updated_at: "2026-11-11T06:27:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122061", "first_seen_at": "2026-11-11T06:25:42+00:00"}]
exploit_sources: []
---

# Event Tickets WordPress plugin: REST API leaks attendee names without authentication

Link for people: https://infrastack.ai/live/CVE-2026-122061 (this .md is for agents)

The Event Tickets and Registration WordPress plugin returns attendee names over its REST API for events that do not publish an attendee list. An unauthenticated visitor can read those names.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Event Tickets and Registration plugin in the WordPress admin under Plugins; affected versions are before `5.30.3.1`.

## Fix

- Event Tickets and Registration plugin: move to `5.30.3.1` or later.

## Timeline

- 2026-11-11T06:25:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122061

## From the sources

The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_