Security Alert Summary
The Event Booking Manager for WooCommerce WordPress plugin contains an access control issue that can allow users with contributor-level access and above to retrieve other authors’ private, draft, and trashed events and related event details that would normally be withheld from users without the read_private_posts capability.
CVE Details
- CVE ID: CVE-2026-91077
- Affected component: Event Booking Manager for WooCommerce (WordPress plugin)
- Affected versions: Versions prior to 5.7.3 (for example, 5.3.6 is listed as affected)
- Published: September 23, 2026 at 6:17:05 AM UTC
- Last modified: September 23, 2026 at 11:17:17 AM UTC
- CVSS v3.1 base score: 2.7 (LOW)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction:
- Privileges Required: High
- User Interaction: None
- Attack Vector: Network
- Primary impact:
- Confidentiality: Low
- Integrity: None
- Availability: None
- Weakness (CWE): CWE-284 (Improper Access Control)
Technical Details
The plugin does not restrict its event listing query to events the requesting user is permitted to read. As a result, users with contributor-level access and higher can retrieve other authors’ private, draft, and trashed events, along with event detail that the standard listing does not show them. In short, the query or its permission checks do not enforce the WordPress capability read_private_posts as intended, allowing disclosure of content that should be withheld from users lacking that capability.
The description does not name specific functions or REST endpoints. The core issue is an access control failure in the listing logic: the plugin returns events without filtering by the requesting user’s read permissions.
How This Could Impact Your Website
Consider a typical small site with an administrator (site owner), internal staff members with editor access, and external contractors or contributors who create event drafts. A contributor-level account could be used to list and retrieve other authors’ private or draft events. That could expose details about internal scheduling, unpublished event content, or other event metadata that you expected to keep private. Disclosure of event details could also reveal contact information or planning notes tied to users, increasing the risk of targeted phishing or social engineering focused on staff or contractors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, such as unexpected queries returning private content.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
