{"affected":[{"defaultStatus":"unaffected","product":"Event Tickets and Registration","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.30.3.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-122061","cwes":["CWE-200"],"description":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a3546a21-e420-4482-8bbd-7d8f9b9c9b56/"}],"kev":null,"metrics":[],"modifiedAt":1794376812196,"publishedAt":1794376812196,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a3546a21-e420-4482-8bbd-7d8f9b9c9b56/"}],"remediation":[],"revision":"23918765a0a41da7a47f2d54b2085af1c949a376eb36a7042b63765bf90a0018","sources":[{"modifiedAt":1794376812196,"name":"CNA: WPScan","retrievedAt":1794377415567,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122061"}],"ssvc":null,"status":"published","title":"Event Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST Endpoint","updatedAt":1794377415567}