CVE-2026-93661CWE-639

CVE-2026-93661

Low · published September 24, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-24T10:17Z
References (1)
https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/ · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 24 SEP 06:00Z
    Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
    cvelistv5