CVE-2026-109994Medium· 6.5▾ SunlitThe Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email address and phone number of any WordPress user, including administrators, by supplying their user id in a query-string parameter while placing the authenticated user's own id in the URL path.
eventin_events_calendar_tickets_registration_booking_woocommerce <= 4.1.29Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62122Medium· 5.3WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
CVE-2026-104674Medium· 4.3WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
CVE-2026-116860Medium· 5.3WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability
CVE-2026-112829Medium· 5.3WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability
CVE-2026-110380Medium· 5.3Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
CVE-2026-109898Medium· 5.3Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.