CVE-2026-93661

Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

Affected

Events Manager

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS

0.17% chance of exploitation in the next 30 days, 6th percentile

Published

2026-09-24

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/
• Hasyros/CVE-2026-93661-idor-events-manager0★ · 2026-10-07

References

• CVE Record
• NVD entry

Related

• CVE-2026-101160
• CVE-2026-101161
• CVE-2026-101162
• CVE-2026-76555