Event Booking Manager For Woocommerce
Monthly
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated WordPress user with Contributor-level access or above on sites running the Event Booking Manager for WooCommerce plugin in versions 5.3.6 up to but not including 5.6.0. The plugin fails to enforce a capability check on the code that renders its stored gateway configuration, so a low-privilege author account can retrieve secrets intended only for administrators; publicly available exploit code exists, and the vendor has released a fix in 5.6.0. The practical risk is moderate rather than critical because a valid Contributor account is required and the plugin must have PayPal and/or Stripe credentials configured, but any site that allows Contributor self-registration or has many low-trust authors should treat the exposure as urgent and rotate keys immediately.
Unauthenticated attackers can retrieve registered attendees' personal information-including full names, email addresses, phone numbers, and custom registration fields-from WordPress sites running Event Booking Manager for WooCommerce versions 5.3.6 through before 5.3.8, but only if the site has enabled the plugin's non-default native (non-WooCommerce) checkout flow. The vulnerability is a broken access control/IDOR issue (CWE-639) where booking confirmation details are rendered without an ownership check, allowing enumeration of booking references to disclose data. Publicly available exploit code exists, but the high attack complexity (CVSS 3.7) reflects the non-default configuration prerequisite and the need to guess valid references; there is no integrity or availability impact.
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated WordPress user with Contributor-level access or above on sites running the Event Booking Manager for WooCommerce plugin in versions 5.3.6 up to but not including 5.6.0. The plugin fails to enforce a capability check on the code that renders its stored gateway configuration, so a low-privilege author account can retrieve secrets intended only for administrators; publicly available exploit code exists, and the vendor has released a fix in 5.6.0. The practical risk is moderate rather than critical because a valid Contributor account is required and the plugin must have PayPal and/or Stripe credentials configured, but any site that allows Contributor self-registration or has many low-trust authors should treat the exposure as urgent and rotate keys immediately.
Unauthenticated attackers can retrieve registered attendees' personal information-including full names, email addresses, phone numbers, and custom registration fields-from WordPress sites running Event Booking Manager for WooCommerce versions 5.3.6 through before 5.3.8, but only if the site has enabled the plugin's non-default native (non-WooCommerce) checkout flow. The vulnerability is a broken access control/IDOR issue (CWE-639) where booking confirmation details are rendered without an ownership check, allowing enumeration of booking references to disclose data. Publicly available exploit code exists, but the high attack complexity (CVSS 3.7) reflects the non-default configuration prerequisite and the need to guess valid references; there is no integrity or availability impact.
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.