{"id":"CVE-2026-122087","aliases":["EUVD-2026-123192","GHSA-4xp7-hp3g-mfgm"],"status":"published","title":"Event Tickets \u003c 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00186,"percentile":0.08278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-11-11T06:00:12Z","modified":"2026-11-11T12:32:44Z","products":[{"vendor":"theeventscalendar","product":"event tickets and registration"},{"vendor":"unknown","product":"event tickets and registration"}],"references":[{"url":"https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-f8449fd4125b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122087"},{"url":"https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-f8449fd4125b"},{"url":"https://github.com/advisories/GHSA-4xp7-hp3g-mfgm"}],"sources":{"cve":[{"id":"CVE-2026-122087","title":"Event Tickets \u003c 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.","status":"published","published":"2026-11-11T06:00:12.367Z","modified":"2026-11-11T11:35:42.332Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123192","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.","status":"published","published":"2026-11-11T06:00:12Z","modified":"2026-11-11T11:35:42Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-11T12:28:31.128551Z"}],"ghsa":[{"id":"GHSA-4xp7-hp3g-mfgm","title":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee...","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.","status":"published","published":"2026-11-11T06:32:41Z","modified":"2026-11-11T12:32:44Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-122087","description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.","status":"published","published":"2026-11-11T06:17:17.56Z","modified":"2026-11-11T12:19:36.64Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}