Events Manager

Wordfence Intelligence published a new cluster of Events Manager vulnerabilities on August 24, 2026. Events Manager – Calendar, Bookings, Tickets, and more! is a widely used WordPress event-management plugin with 60,000+ active installations, and the new records cover SQL injection, information disclosure, reflected cross-site scripting, and administrator-level local file inclusion paths.

The immediate action is straightforward: update Events Manager to version 7.4.1 or newer. WordPress.org currently lists 7.4.2 as the latest release, and its changelog confirms security fixes in the 7.4.1 and 7.4.2 branches.

New August 24 Vulnerabilities

Technical Impact

• Reflected XSS: the shortcode flow sanitizes header_format, but the unauthenticated grouped-event AJAX path bypasses that sanitization before output.
• Local file inclusion: an administrator-level settings path can store a traversal key that is later included through include_once() during admin_init. If a PHP file can also be uploaded or placed on the server, this can become code execution.
• Information disclosure: unauthenticated requests can expose event and location titles, dates, descriptions, and location details for content that should remain private, draft, pending, or trashed.
• Second-order SQL injection: a Contributor+ user can store unsafe post meta keys and later trigger unsafe SQL construction during event or location duplication.

Immediate Remediation

• Update Events Manager to 7.4.1 or newer. Prefer the current 7.4.2 release unless your site has a specific tested version pin.
• Review sites that allow guest event submissions, Contributor accounts, or multi-author event management first.
• Review event and location drafts or private records for accidental exposure risk.
• Audit recent administrator settings changes if the site was running an affected 7.3.x build.
• Temporarily disable Events Manager if you cannot patch and the site allows untrusted users to create or edit event content.

WP-CLI Verification

wp plugin get events-manager --fields=name,version,status
wp plugin update events-manager
wp plugin get events-manager --field=version

After updating, confirm event-management roles and review recent modified events and locations.

wp post list --post_type=event,location,event-recurring --post_status=any --fields=ID,post_type,post_status,post_author,post_modified --orderby=modified --order=DESC --posts_per_page=50
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
wp user list --role=author --fields=ID,user_login,user_email,user_registered

Database Review

This read-only query helps locate suspicious event/location meta keys that deserve manual review after the SQL injection disclosure. It does not prove exploitation by itself.

wp db query "SELECT p.ID,p.post_type,p.post_status,pm.meta_key FROM {prefix}posts p JOIN {prefix}postmeta pm ON pm.post_id=p.ID WHERE p.post_type IN ('event','location','event-recurring') AND (pm.meta_key LIKE '%;%' OR pm.meta_key LIKE '%--%' OR pm.meta_key LIKE '%/*%') LIMIT 50;"

Temporary Mitigation

The correct fix is the plugin update. If patching is delayed, reduce exposure by disabling guest submissions, removing untrusted Contributor/Author access, and blocking unauthenticated Events Manager AJAX search endpoints at the edge. Test any rule on staging first because event search and calendar widgets may depend on AJAX.

# Temporary containment only; update the plugin as the permanent fix.
wp plugin deactivate events-manager

Sources

• Wordfence: CVE-2026-17089 reflected XSS
• Wordfence: CVE-2026-14280 local file inclusion
• Wordfence: CVE-2026-10627 information disclosure
• Wordfence: CVE-2026-15023 SQL injection
• WordPress.org Events Manager plugin page and changelog