What is the CVSS score of CVE-2026-17166?

CVE-2026-17166 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Event Booking Manager for WooCommerce CVE-2026-17166

EUVD-2026-50098 MEDIUM

Missing Authorization (CWE-862)

2026-07-29 security@wordfence.com

GHSA-6p3r-44rr-gcj5

WordPress Authentication Bypass

4.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributor-level authentication required for network requests; integrity impact limited to payment settings only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 02:30 vuln.today

CVE Published

Jul 29, 2026 - 02:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Event Booking Manager for WooCommerce - Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings - including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses - that govern how all event bookings are processed.

AnalysisAI

Authenticated authorization bypass in Event Booking Manager for WooCommerce ≤5.3.7 allows contributor-level users to modify site‑wide WooCommerce payment settings - including enabling/disabling payments, altering cart redirects, login requirements, confirmation pages, and ticket statuses - undermining booking integrity and checkout flows. No active exploitation or public exploit is currently reported.

Technical ContextAI

The vulnerability lies in the WordPress plugin's admin settings panel (admin_setting_panel.php) where sensitive payment‑related options are handled without proper capability checks (CWE‑862 Missing Authorization). An authenticated user with only contributor‑level access can submit requests to these endpoints and alter settings that should be restricted to shop managers or administrators. The affected files process payment enablement, cart redirect, login requirements, confirmation page IDs, and ticket statuses, all critical to WooCommerce‑based event booking operations. CPE: cpe:2.3:a:magepeople:event_booking_manager_for_woocommerce:*:*:*:*:*:wordpress:*:* (versions up to and including 5.3.7).

RemediationAI

No official patched release is yet available. The remediation is to update to the next version as soon as it is released by the vendor (the fix has been committed to trunk, see changeset https://plugins.trac.wordpress.org/changeset?reponame=&old=3625494%40mage-eventpress&new=3625494%40mage-eventpress). Until then, immediate mitigations: remove contributor‑level users who do not need dashboard access, or use a capability manager plugin to revoke the 'edit_posts' or similar capability that permits access to admin settings. Alternatively, deploy a Web Application Firewall rule blocking requests to /wp-admin/admin.php?page=mage_eventpress&tab=payment with contributor‑level authenticated sessions. Note: removing contributor access may impact legitimate content creation roles.