{"id":"CVE-2026-93661","aliases":["EUVD-2026-85808","GHSA-m227-gvmr-hx3v"],"status":"published","title":"Events Manager \u003c 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR","description":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00187,"percentile":0.08374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-639"],"published":"2026-09-24T06:00:20Z","modified":"2026-09-24T14:42:02Z","exploits":[{"source":"pocgithub","id":"Hasyros/CVE-2026-93661-idor-events-manager","title":"Hasyros/CVE-2026-93661-idor-events-manager","date":"2026-09-19","url":"https://github.com/Hasyros/CVE-2026-93661-idor-events-manager"}],"products":[{"vendor":"pixelite","product":"events manager"},{"vendor":"unknown","product":"events manager"}],"references":[{"url":"https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93661"},{"url":"https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611"},{"url":"https://github.com/advisories/GHSA-m227-gvmr-hx3v"}],"sources":{"cve":[{"id":"CVE-2026-93661","title":"Events Manager \u003c 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR","description":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","status":"published","published":"2026-09-24T06:00:20.439Z","modified":"2026-09-24T10:41:54.37Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-85808","description":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","status":"published","published":"2026-09-24T06:00:20Z","modified":"2026-09-24T10:41:54Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-m227-gvmr-hx3v","title":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from...","description":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","status":"published","published":"2026-09-24T06:31:16Z","modified":"2026-09-24T12:31:23Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:12:22.2852Z"}],"nvd":[{"id":"CVE-2026-93661","description":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.","status":"published","published":"2026-09-24T06:17:03.943Z","modified":"2026-09-24T14:42:02.707Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:51.036099Z"}]}}