CVE-2026-109994

Name of the Vulnerable Software and Affected Versions Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce versions prior to 4.1.30

Description Authenticated attackers with subscriber-level access and above can extract the email address and phone number of any WordPress user, including administrators. This occurs by supplying a target user's id in a query-string parameter while placing the attacker's own id in the URL path.

Recommendations Update the plugin to version 4.1.30 or later.