CVE-2026-93661: Unknown Events Manager

Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days.

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

Affected products

• Unknown Events Manager: before 7.4.5 (fixed in 7.4.5)

Published 2026-09-24. Last modified 2026-09-24.