CVE-2026-91008: low-severity vulnerability in Event Booking Manager for WooCommerce
Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 3.7epss 0.3%
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Event Booking Manager for WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/f3bcee4d-06b8-40bd-a4e6-91c671f405c6/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Event Booking Manager for WooCommerce
In the same product, most dangerous first.
CVE-2026-16062MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentEPSS 2.2%CVE-2026-91019MEDIUMEvent Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureEPSS 0.4%CVE-2026-91077LOWEvent Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_listEPSS 0.3%CVE-2026-16064MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_eventEPSS 0.2%CVE-2026-16063MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentEPSS 0.2%