What’s Vulnerable › Vulnerabilities
CVE-2026-91008: Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-18
- Weakness: CWE-639
Description
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
Affected products
- Event Booking Manager for WooCommerce: from 5.3.6 before 5.3.8 — fixed in 5.3.8
How to fix
Upgrade to a fixed version: Event Booking Manager for WooCommerce 5.3.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-91008 or the next vulnerability affects your stack