These are security releases for the free plugin and Pro. Please update as soon as you can.
Last week we opened the Security Hunt, asking you to point your own AI at Events Manager and report what it finds before anyone else does. It is working: in the first few days, three people reported nine security issues across Events Manager, Pro and two add-ons, all reproduced and fixed before any detail went public. We have held the specifics back for now so sites can update first.
We will post the scoreboard in the coming days. The hunt runs until November 30, with a lifetime Pro license for whoever tops it, and there is still plenty to find. If you want in, the rules and the AI prompts are on the hunt page.
Changelog
Events Manager 7.4.11
- Security: Fixed an unauthenticated information disclosure vulnerability that could expose event owner details, reported by mercurystorm via the Security Hunt
- Security: File upload display names are now stored as plain text, reported by mercurystorm via the Security Hunt
- Security: Fixed an unauthenticated information disclosure where request status parameters could expose draft, pending and trashed events and locations, reported by Lewis Studios via the Security Hunt
- Security: Fixed a booking takeover where a contributor or author could re-save another user’s booking onto an event they own, exposing that booker’s details, reported by Lewis Studios via the Security Hunt
- Security: An OAuth connection limited to Events Manager is now refused over XML-RPC instead of acting with the account’s full access, reported by Will Pom via the Security Hunt
Events Manager Pro 3.9.8
- Security: Fixed an unauthenticated stored cross-site scripting vulnerability in booking form file uploads, reported by mercurystorm via the Security Hunt
- Security: The coupon check endpoint now requires the booking form nonce, so coupon codes can no longer be brute-forced anonymously, reported by Will Pom via the Security Hunt