This is a follow-up security release for the free plugin. Please update as soon as you can.

Yesterday’s 7.4.11 closed an unauthenticated information disclosure, and as we released a separate hunter found a related path it did not cover. 7.4.12 closes it on both of those endpoints.

That is the hunt working as intended, a second pair of eyes catching what our first fix missed, privately and before anyone else. The Security Hunt runs until November 30, the scoreboard goes live in the coming days, and there is a lifetime Pro license for whoever tops it.

Our thanks to 0xtrung.

Changelog

Events Manager 7.4.12

• Security: Fixed an unauthenticated information disclosure where the map data endpoints could expose details of draft, pending and private locations, reported by 0xtrung via the Security Hunt