CVE-2026-93661: Events Manager WordPress Auth Bypass Flaw

CVE-2026-93661 Overview

CVE-2026-93661 is an Insecure Direct Object Reference (IDOR) vulnerability in the Events Manager WordPress plugin versions prior to 7.4.5. The plugin fails to validate that ticket identifiers submitted in a ticket-update request match the tickets the requesting user is authorized to modify. An authenticated user with permission to manage one event's tickets can replace those identifiers and overwrite any ticket on the site, reassigning it to an event they control. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated event managers can hijack and reassign tickets belonging to other events across the entire site, corrupting ticket ownership and event integrity.

Affected Products

Events Manager WordPress plugin, all versions prior to 7.4.5
WordPress sites running the vulnerable plugin with multiple event managers
Multi-organizer WordPress environments relying on per-event ticket segregation

Discovery Timeline

2026-09-24 - CVE-2026-93661 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93661

Vulnerability Analysis

The Events Manager plugin exposes a ticket-update workflow intended for event organizers to modify tickets associated with events they manage. The authorization check validates that the requester holds management rights on the event referenced in their session or capability context. However, the plugin does not re-validate that the ticket identifiers submitted in the request body actually belong to the authorized event.

An attacker with legitimate manage_event_tickets capability on at least one event can submit arbitrary ticket IDs in the update payload. The plugin processes those IDs without cross-checking ownership, then reassigns the targeted tickets to the attacker's event. This permits ticket theft, event metadata corruption, and arbitrary modification of ticket records across unrelated events.

Root Cause

The root cause is missing object-level authorization. The plugin trusts the ticket identifiers supplied by the client instead of enforcing that each referenced ticket belongs to an event the user is authorized to manage. This pattern is classified under CWE-639.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with ticket-management privileges on any single event. The attacker intercepts or crafts a ticket-update request, substitutes legitimate ticket identifiers with IDs belonging to another event, and submits the request. The server accepts the modification, reassigning target tickets to the attacker's event.

No verified proof-of-concept code is published. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-93661

Indicators of Compromise

Ticket records in the wp_em_tickets table whose event_id changed without a corresponding administrative action
Unexpected ticket count increases for events owned by low-privilege organizers
Audit log entries showing ticket-update requests from accounts that do not manage the referenced ticket's parent event

Detection Strategies

Review database audit trails for ticket reassignment events where the actor lacks ownership of the source event
Correlate HTTP POST requests to Events Manager ticket endpoints with the authenticated user's event management scope
Baseline ticket-to-event mappings and alert on identifier changes outside expected administrative workflows

Monitoring Recommendations

Enable WordPress audit logging plugins to capture ticket modification events with before and after values
Monitor web server logs for repeated ticket-update POST requests from a single authenticated session targeting varying ticket IDs
Alert on administrative actions originating from accounts with limited event scope

How to Mitigate CVE-2026-93661

Immediate Actions Required

Upgrade the Events Manager plugin to version 7.4.5 or later on all WordPress installations
Audit existing ticket records to verify event_id assignments match legitimate organizer scope
Review accounts with event-management capabilities and remove unnecessary privileges

Patch Information

The vendor fixed the issue in Events Manager version 7.4.5. The patch adds server-side validation ensuring that every ticket identifier in an update request belongs to an event the requester is authorized to manage. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict event-management capabilities to trusted administrators until the plugin is updated
Deploy a Web Application Firewall rule to inspect and block ticket-update requests containing identifiers outside the user's event scope
Temporarily disable the Events Manager plugin on sites that cannot upgrade immediately

bash

# Verify the installed Events Manager version via WP-CLI
wp plugin get events-manager --field=version

# Upgrade to the patched release
wp plugin update events-manager --version=7.4.5