Events Manager 7.4.11 fixes 9 flaws, one leaks other bookings

If your site uses Events Manager for event bookings, Oct 25, 2026 brought an update that should not wait. Version 7.4.11 for the free plugin and 3.9.8 for Pro close nine security issues, and the team held back the details on purpose so sites can update before everyone knows them. The safe update window is open now, but not for long.

What shipped on Oct 25?

Events Manager shipped two security releases together on Oct 25, 2026: 7.4.11 for the free plugin and 3.9.8 for Pro, plus updates for two add-ons: Stripe 2.5.2 and Connect 1.0.1. All four came out the same day, and all of them came from the Security Hunt the team opened the week before.

In the first days of the hunt, three researchers reported nine security issues across the plugin, Pro, and the two add-ons, and the team reproduced and fixed all of them before any detail went public. The official post says plainly that the details are held back so sites update first, and that the scoreboard will be published in the coming days.

Which flaw affects you most?

The free plugin has five fixes. The worst for your customers' privacy is booking takeover: a contributor or author could re-save another user's booking onto an event they own, and see that booker's details. A low role on the site reaches data of people who have nothing to do with them.

There is also unauthenticated disclosure from two sides: one exposes event owner details, and the other exposes draft, pending, and trashed events and locations through request status parameters. Any visitor without an account could see things that should have stayed hidden until publication.

Pro has two fixes: an unauthenticated stored XSS flaw in booking form file uploads, and a change that makes the coupon check require the booking form nonce, so coupon codes can no longer be tried anonymously until one works.

This is a pattern seen before in WordPress plugins: a low role reaching higher privileges or someone else's data. The aBlocks plugin had a contributor-to-editor privilege escalation flaw, and here a contributor reaches someone else's booking. The difference is that Events Manager fixed everything in one batch before publishing the details.

What about the Stripe and Connect add-ons?

Stripe 2.5.2 fixes a payment flaw: a single paid Stripe PaymentIntent could approve more than one booking. A customer pays once, and the system approves extra bookings that were never paid for. If you take paid bookings through the Stripe Elements gateway, this fix alone is worth updating today.

Connect 1.0.1 hardens webhook secret checks for WhatsApp and Telegram: it rejects blank and forged secrets, and compares them in constant time. Any integration that relies on a weakly checked webhook secret stays an open door for fake requests.

Why are the details held back now?

Because the team chose responsible disclosure over curiosity. The hunt is running, researchers are finding flaws, and if the details were published before sites updated, every old site would become a ready target. The post says the scoreboard is coming in the coming days, the hunt runs until November 30, and the top finder gets a lifetime Pro license.

That order works for you if you move now: update while you are safe, then read the details when they are published and check that your fix covered them. If you wait, you will read the details while still exposed.

What to do now?

The order matters: update first, then review, and pause only if you cannot update right now.

1. Update the free Events Manager plugin to 7.4.11 and Pro to 3.9.8 from the WordPress dashboard.

2. If you have the Stripe add-on, update it to 2.5.2, and if you have Connect, update it to 1.0.1.

3. Review your recent bookings for any booking approved without a matching payment, and for any contributor or author account that touched other people's bookings.

4. If you cannot update now, pause paid Stripe bookings temporarily until you update, because the payment flaw is the one with direct loss.

And remember that your other WordPress plugins may be in the same position. Stolen UpdraftCentral keys opened backdoors in WordPress sites, and late updating was part of the problem there too.

When did you last review your WordPress plugins?

Nine flaws in one batch is not a sign that the plugin is bad. It is a sign that someone is auditing it seriously right now, and that the next batch of results is coming with the hunt scoreboard.

If you run Events Manager on your site, update today, then ask yourself: which other plugin of yours has not been updated in months, and who is auditing it right now?

If you want someone to check these settings before anyone else finds them, Muhassan audits your platform and hands you a clear fix plan.