Authorization Flaw in Event Booking Manager for WooCommerce Plugin by WordPress
CVE-2026-91077
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 September 2026
Badges
What is CVE-2026-91077?
The Event Booking Manager for WooCommerce plugin for WordPress prior to version 5.7.3 is susceptible to an authorization flaw. This vulnerability allows users with contributor-level access and above to bypass restrictions and access private, draft, or trashed events that they should not be permitted to see. The flaw occurs because the event listing query does not adequately restrict access, enabling unauthorized users to retrieve sensitive event details that should remain hidden. This can lead to the unintended disclosure of private events and their content.
Affected Version(s)
Event Booking Manager for WooCommerce 5.3.6 < 5.7.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.