Events Manager CVE-2026-93661

Exploitation requires an authenticated WordPress account that already has permission to manage tickets for at least one event in the Events Manager plugin (an event organizer/manager, reflected as PR:H). The attacker then abuses a ticket-update request by substituting ticket identifiers belonging to events they do not control; the plugin fails to re-verify ownership of the submitted identifiers, allowing overwrite and reassignment of any ticket site-wide. Limiting factors: the flaw is confined to sites running Events Manager before 7.4.5, no unauthenticated or low-privilege access works (privileged event-management role is mandatory), no user interaction is needed, and impact is limited to integrity of ticket records (no data disclosure or downtime).

This is a genuinely low-priority vulnerability despite being real and patched. The CVSS 3.1 base score is 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N), driven down by PR:H (attacker must already hold privileges to manage at least one event's tickets) and impact limited to I:L only (integrity, no confidentiality or availability effect). All secondary signals agree on low urgency: SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial; there is no EPSS listing and the CVE is not in CISA KEV. The one signal that raises attention is that publicly available exploit code exists (WPScan), but POC availability is a distinct signal from active exploitation and here SSVC still records exploitation as 'none' - no evidence of in-the-wild use. Net: a real, verified authorization/IDOR flaw worth patching in routine maintenance, but not an emergency. No signals conflict; the CVSS, SSVC, and absence of EPSS/KEV all point the same direction (low real-world risk gated behind privileged access).

A user who legitimately manages tickets for one event (an event organizer/manager role) submits a ticket-update request but tampers with the ticket identifiers so the request targets a ticket belonging to a different event on the same site. Because the plugin does not re-verify that the submitted identifiers still match the ticket the request was authorized against, the attacker overwrites that ticket and reassigns it to their own event. Public exploit code is available via WPScan, but exploitation requires the attacker to already hold event-management privileges.