Data Exposure Vulnerability in Event Tickets and Registration Plugin by WordPress
CVE-2026-122087

Currently unrated

Key Information:

Vendor

WordPress
Status
Event Tickets And Registration
Vendor
CVE Published:
11 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-122087?

The Event Tickets and Registration plugin prior to version 5.30.3.1 for WordPress contains a vulnerability that fails to restrict access to attendee data; this allows unauthenticated users to retrieve information about attendees from private events as well as events that are not public. This weakness makes it possible for unauthorized individuals to gain insights into event attendees, posing privacy risks and potential misuse of personal data.

Affected Version(s)

Event Tickets and Registration 0 < 5.30.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-122087 - Proof of Concept

References

https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron - WellKnown
WPScan
.