EUVD-2026-85059
GHSA-x59c-4q2g-w5j4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Description states exploitation needs only contributor-level access, so PR:L (not PR:H); network vector, low complexity, no UI; confidentiality-only disclosure so C:L, I:N, A:N.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
7DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
AnalysisAI
Information disclosure in the Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 through 5.7.2) lets authenticated users holding Contributor-level privileges or above enumerate and read other authors' private, draft, and trashed events, along with event detail that the normal listing view withholds. The flaw is an authorization/access-control defect (CWE-284) rather than remote code execution: it is read-only, requires an existing WordPress account with at least Contributor rights, and cannot be triggered by an anonymous visitor, so the practical risk depends heavily on how readily a site hands out contributor accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with at least Contributor-level privileges on a site running Event Booking Manager for WooCommerce versions 5.3.6 through 5.7.2; the site must have the plugin installed and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by updating Event Booking Manager for WooCommerce to version 5.7.3 or later - this is the only complete fix, since the defective listing query must be corrected in plugin code; the change should be verified against the WPScan advisory at https://wpscan.com/vulnerability/9db8d1c4-2bf8-4259-b95f-b131fc385a2e/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-91077. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today