CVE-2026-122087lowCWE-200

CVE-2026-122087: low-severity vulnerability in Event Tickets and Registration

Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API

Published

Follow this CVE+ Monitor Event Tickets and Registration

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 3.7epss 0.2%
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Event Tickets and Registration
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Event Tickets and Registration

In the same product, most dangerous first.

CVE-2024-1316MEDIUMEvent Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events AccessEPSS 0.6%CVE-2026-14822MEDIUMEvent Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status ManipulationEPSS 0.3%CVE-2026-122061MEDIUMEvent Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST EndpointEPSS 0.3%CVE-2026-14819LOWEvent Tickets < 5.28.4 - Editor+ Stored XSS via Ticket MoveEPSS 0.2%CVE-2026-14823LOWEvent Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOREPSS 0.2%