CVE-2026-17166mediumCWE-862

CVE-2026-17166: falha de média gravidade em magepeopleteam Event Booking Manager for…

Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action

Publicada em

Seguir esta CVE+ Monitorar Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
magepeopleteam · Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
CVEs relacionadas — magepeopleteam Event Booking Manager for…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-109381HIGHEvent Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' ParameterEPSS 0.4%