{"id":"CVE-2026-122087","kind":"vulnerability","aliases":["CVE-2026-122087"],"related":[],"title":"Event Tickets and Registration WordPress plugin: unauthenticated users can read private attendee data","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.","summary":"The Event Tickets and Registration WordPress plugin does not limit attendee lists to events the requester may view. An unauthenticated visitor can retrieve attendee data for private and other non-public events.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-tickets","package","self-hosted","wordpress"],"not_affected_if":["no-private-events","plugin-updated"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin's main file header `Version:`.\n- Versions below `5.30.3.1` are in the affected range.","fix":"- Event Tickets and Registration: `5.30.3.1`","status":"open","published_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:24+00:00","updated_at":"2026-11-11T06:27:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:24Z","model":"claude-haiku-5-5","output":{"fix":"- Event Tickets and Registration: `5.30.3.1`","reach":"internet","title":"Event Tickets and Registration WordPress plugin: unauthenticated users can read private attendee data","impact":"medium","summary":"The Event Tickets and Registration WordPress plugin does not limit attendee lists to events the requester may view. An unauthenticated visitor can retrieve attendee data for private and other non-public events.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","event-tickets","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attendee personal data for private events readable by anyone","analyst_note":"","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin's main file header `Version:`.\n- Versions below `5.30.3.1` are in the affected range.\n- unknown for other checks: the sources do not say which endpoint or setting is involved.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-updated","no-private-events"],"who_is_affected":"Sites running the Event Tickets and Registration plugin before `5.30.3.1` that host private or non-public events with attendee lists. Sites without private events, or with the plugin updated, are not exposed through this flaw. Whether an attacker can reach the data without logging in is stated by the description: it is unauthenticated.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4526,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122087':16A,19A '-2026':15A,18A '5.30.3.1':69C 'allow':80C,83C 'attende':12A,38B,51B,73C,89C 'cve':14A,17A 'data':13A,52B,74C 'event':1A,21B,29B,41B,60B,62C,76C,97C 'event-ticket':20B 'host':26B 'limit':37B 'list':39B 'may':44B 'non':58B,95C 'non-publ':57B,94C 'packag':23B 'plugin':6A,34B,67C 'privat':11A,54B,91C 'public':59B,96C 'read':10A 'registr':4A,32B,65C 'request':43B,78C 'restrict':72C 'retriev':50B,87C 'self':25B 'self-host':24B 'ticket':2A,22B,30B,63C 'unauthent':7A,47B,84C 'user':8A,85C 'view':45B,82C 'visitor':48B 'wordpress':5A,27B,33B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event Tickets and Registration plugin before `5.30.3.1` that host private or non-public events with attendee lists. Sites without private events, or with the plugin updated, are not exposed through this flaw. Whether an attacker can reach the data without logging in is stated by the description: it is unauthenticated.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventtickets","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-122087':16A,19A '-2026':15A,18A 'attende':12A 'cve':14A,17A 'data':13A 'event':1A 'plugin':6A 'privat':11A 'read':10A 'registr':4A 'ticket':2A 'unauthent':7A 'user':8A 'wordpress':5A","search_b":"'attende':38B,51B 'data':52B 'event':21B,29B,41B,60B 'event-ticket':20B 'host':26B 'limit':37B 'list':39B 'may':44B 'non':58B 'non-publ':57B 'packag':23B 'plugin':34B 'privat':54B 'public':59B 'registr':32B 'request':43B 'retriev':50B 'self':25B 'self-host':24B 'ticket':22B,30B 'unauthent':47B 'view':45B 'visitor':48B 'wordpress':27B,33B","search_c":"'5.30.3.1':69C 'allow':80C,83C 'attende':73C,89C 'data':74C 'event':62C,76C,97C 'non':95C 'non-publ':94C 'plugin':67C 'privat':91C 'public':96C 'registr':65C 'request':78C 'restrict':72C 'retriev':87C 'ticket':63C 'unauthent':84C 'user':85C 'view':82C 'wordpress':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122087","severity":null,"published_at":"2026-11-11T06:17:17+00:00","modified_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}