Sensitive Information Exposure in Eventin Events Calendar Plugin by WordPress

CVE-2026-109994

What is CVE-2026-109994?

The Eventin Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is exposed to a vulnerability that allows authenticated users, such as subscribers, to access sensitive information. This flaw arises from inadequate validation of the 'id' parameter in requests, enabling attackers to retrieve email addresses and phone numbers of users, including administrators. By crafting a specific query with the victim's user ID, malicious actors can exploit this weakness, potentially leading to unauthorized disclosure of private data.

References