Information Disclosure Vulnerability in Event Booking Manager for WooCommerce Plugin
CVE-2026-91008
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-91008?
The Event Booking Manager for WooCommerce plugin for WordPress prior to version 5.3.8 has a vulnerability that permits unauthenticated attackers to access sensitive information of registered attendees. Specifically, the plugin fails to implement necessary ownership and authorization checks for booking confirmation details. This allows attackers to exploit an enumerable booking reference to retrieve personal data including full names, email addresses, phone numbers, and any custom registration fields. This issue is limited to environments where the plugin is configured to utilize its native checkout system instead of the default WooCommerce checkout.
Affected Version(s)
Event Booking Manager for WooCommerce 5.3.6 < 5.3.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.