EUVD-2026-81358
GHSA-2pgf-j495-ffj6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Contributor is a low-privilege role so PR:L (not PR:H); full secret-key disclosure justifies C:H; no integrity/availability impact, no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
AnalysisAI
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated WordPress user with Contributor-level access or above on sites running the Event Booking Manager for WooCommerce plugin in versions 5.3.6 up to but not including 5.6.0. The plugin fails to enforce a capability check on the code that renders its stored gateway configuration, so a low-privilege author account can retrieve secrets intended only for administrators; publicly available exploit code exists, and the vendor has released a fix in 5.6.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with Contributor-level role or above on a site running Event Booking Manager for WooCommerce version 5.3.6 up to (not including) 5.6.0; the plugin must have PayPal and/or Stripe gateway credentials configured for there to be secrets to steal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority credential-disclosure flaw whose real risk hinges on a privilege nuance the vendor score obscures. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Event Booking Manager for WooCommerce to 5.6.0 or later - this is the vendor-released fix and the only complete remediation, per the WPScan advisory (https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/) and the VulDB entry (https://vuldb.com/vuln/406330). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows au
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) pe
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3
Unauthenticated attackers can retrieve registered attendees' personal information-including full names, email addresses,
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today