CVE-2026-10627

Name of the Vulnerable Software and Affected Versions Events Manager – Calendar, Bookings, Tickets, and more! versions prior to 7.4.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to access sensitive information, including titles, dates, descriptions, and location details of events and locations that have been marked as draft, pending, trashed, or private.

Recommendations Update the plugin to a version newer than 7.4.0.