---
id: "CVE-2026-122087"
page: "https://infrastack.ai/live/CVE-2026-122087"
kind: "vulnerability"
aliases: ["CVE-2026-122087"]
title: "Event Tickets and Registration WordPress plugin: unauthenticated users can read private attendee data"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["event-tickets", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-private-events", "plugin-updated"]
published_at: "2026-11-11T06:17:17+00:00"
first_seen_at: "2026-11-11T06:25:42+00:00"
updated_at: "2026-11-11T06:27:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122087", "first_seen_at": "2026-11-11T06:25:42+00:00"}]
exploit_sources: []
---

# Event Tickets and Registration WordPress plugin: unauthenticated users can read private attendee data

Link for people: https://infrastack.ai/live/CVE-2026-122087 (this .md is for agents)

The Event Tickets and Registration WordPress plugin does not limit attendee lists to events the requester may view. An unauthenticated visitor can retrieve attendee data for private and other non-public events.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in WordPress admin under Plugins, or in the plugin's main file header `Version:`.
- Versions below `5.30.3.1` are in the affected range.

## Fix

- Event Tickets and Registration: `5.30.3.1`

## Timeline

- 2026-11-11T06:25:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122087

## From the sources

The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_