CVE-2026-91008 in Event Booking Manager Plugin
Summary
by MITRE • 09/17/2026
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in versions of the Event Booking Manager for WooCommerce prior to release 5.3.8 represents a critical failure in access control mechanisms within the WordPress ecosystem. This flaw specifically affects sites that have opted into using the plugin's native checkout system rather than integrating with the standard WooCommerce checkout flow, which is not enabled by default but remains available as an alternative configuration option. The core technical deficiency lies in the absence of proper authorization checks when rendering booking confirmation details. In a secure application architecture, any endpoint or function responsible for displaying sensitive user data must verify that the requesting entity has legitimate ownership over the requested resource or possesses sufficient privileges to access it. Here, the system fails to validate whether the individual making the request is actually associated with the specific booking being queried, thereby bypassing fundamental security principles regarding data isolation and privacy protection.
From a technical perspective, this vulnerability allows unauthenticated attackers to exploit an enumeration-based attack vector against the application's booking reference identifiers. By supplying sequentially generated or guessed booking references, an attacker can iterate through potential valid IDs until they encounter one that returns a successful response containing personal information. The data exposed includes highly sensitive personally identifiable information such as full names, email addresses, phone numbers, and any custom registration fields configured by the event organizer. This type of exposure is classified under CWE-284 Improper Access Control, specifically reflecting a lack of object-level authorization checks. Furthermore, because the exploitation relies on systematically testing input values to discover valid resources, it aligns with ATT&CK technique T1596.001 Scan Target Information for Web Applications, where adversaries probe endpoints using enumerable identifiers like sequential IDs or predictable hashes to gather intelligence about users and their activities without needing prior authentication credentials.
The operational impact of this vulnerability is significant due to the nature of the data involved. Event booking systems typically collect detailed personal information from attendees who expect a high degree of privacy regarding their participation in events, conferences, or workshops. The unauthorized disclosure of names combined with contact details such as email addresses and phone numbers creates substantial risks for those individuals, including potential phishing campaigns, social engineering attacks, spamming, and identity theft. For event organizers and website administrators, this breach constitutes a violation of data protection regulations such as GDPR in Europe or CCPA in California, potentially leading to legal liabilities, reputational damage, and loss of trust among their customer base. The fact that the vulnerability is limited to non-default configurations does not mitigate its severity for those affected sites, as any site utilizing the native checkout feature remains fully exploitable by remote attackers with minimal technical effort.
Mitigation strategies must prioritize immediate remediation through software updates while implementing compensating controls in the interim. Administrators running vulnerable versions of Event Booking Manager for WooCommerce should upgrade to version 5.3.8 or later, where this authorization check has been properly implemented to ensure that only authenticated users associated with a booking can view its confirmation details. If upgrading is not immediately feasible due to compatibility constraints, site administrators should consider disabling the native checkout feature and reverting to the standard WooCommerce checkout process, which likely employs more robust authentication flows inherent to the broader WordPress-WooCommerce integration. Additionally, implementing rate limiting on endpoints that handle booking references can help mitigate enumeration attacks by slowing down automated scanning tools. Security monitoring should also be enhanced to detect unusual patterns of requests targeting sequential or predictable identifiers, providing an early warning system for potential exploitation attempts in real-time environments where patching delays might occur.