CVE-2026-122087 · Package
NO FIX YET · SEE WHAT TO DO
The Event Tickets and Registration WordPress plugin does not limit attendee lists to events the requester may view. An unauthenticated visitor can retrieve attendee data for private and other non-public events.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Event Tickets and Registration plugin before 5.30.3.1 that host private or non-public events with attendee lists. Sites without private events, or with the plugin updated, are not exposed through this flaw. Whether an attacker can reach the data without logging in is stated by the description: it is unauthenticated.
Not affected if no-private-events, plugin-updated
Who cares event-tickets, self-hosted, wordpress
Version:.5.30.3.1 are in the affected range.5.30.3.1The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.