CVE-2026-17166: WooCommerce Event Booking Auth Bypass Flaw

CVE-2026-17166 Overview

CVE-2026-17166 is an authorization bypass vulnerability [CWE-862] in the Event Booking Manager for WooCommerce WordPress plugin, also known as mage-eventpress. The plugin advertises features for selling tickets, event registration, RSVP, and event calendars. All versions up to and including 5.3.7 fail to properly verify user authorization before executing sensitive administrative actions.

Authenticated users with contributor-level access or higher can modify site-wide payment settings that govern how every event booking is processed. Affected settings include WooCommerce payment enablement, cart redirect behavior, checkout login requirements, confirmation page ID, and confirmed ticket status values.

Critical Impact
Contributor-level attackers can alter payment and checkout settings that control every event booking on the site, enabling booking manipulation and business logic abuse.

Affected Products

Event Booking Manager for WooCommerce (mage-eventpress) — versions up to and including 5.3.7
WordPress sites running the plugin with contributor-level or higher user accounts
E-commerce deployments relying on the plugin for ticket sales and RSVP workflows

Discovery Timeline

2026-07-29 - CVE-2026-17166 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17166

Vulnerability Analysis

The vulnerability is a missing authorization check [CWE-862] in the plugin's global administrative settings handler at admin/settings/global/admin_setting_panel.php. The affected code paths, referenced at lines 25, 1080, and 1120 of the file in tags/5.3.7, expose settings mutation endpoints without verifying whether the caller holds an administrative capability such as manage_options.

Contributor accounts are a low-privilege WordPress role intended only to draft posts. When such users can reach settings-write endpoints, the plugin permits changes to payment enablement flags, cart redirect behavior, checkout login requirements, the confirmation page ID, and the values that mark tickets as confirmed. These fields directly govern the booking pipeline.

Exploitation does not require user interaction. The attack originates over the network against an authenticated session and modifies stored plugin options in the WordPress database.

Root Cause

The plugin handler processes incoming settings updates without calling current_user_can() for a privileged capability. Nonce checks alone, if present, only bind a request to a session and do not enforce role authorization. Any authenticated user who can obtain the settings nonce reaches the write path.

Attack Vector

An attacker registers or compromises a contributor-level account. The account issues a request to the vulnerable administrative settings endpoint with crafted parameters targeting the payment and checkout options. The plugin persists the values without an authorization gate, and the modified options take effect for every subsequent booking transaction. See the Wordfence Vulnerability Report and the WordPress plugin source at line 25 for the vulnerable handler location.

Detection Methods for CVE-2026-17166

Indicators of Compromise

Unexpected changes to mage-eventpress plugin options in the wp_options table, particularly payment, cart redirect, and confirmation page settings
POST requests to admin-ajax.php or admin_setting_panel.php handlers originating from contributor or author accounts
New or dormant contributor accounts becoming active shortly before booking configuration changes
Bookings marked as confirmed without a corresponding successful WooCommerce payment record

Detection Strategies

Audit WordPress access logs for requests to admin/settings/global/admin_setting_panel.php correlated with non-administrator session cookies
Enable and review WordPress option-change auditing to flag writes to plugin settings by non-administrator users
Compare current plugin option values against a known-good baseline captured before the exposure window

Monitoring Recommendations

Alert on any modification of payment-related plugin options outside a change-management window
Monitor for privilege escalation patterns where low-role accounts perform settings writes
Track booking confirmations that do not map to a completed WooCommerce order to catch abuse of altered confirmation logic

How to Mitigate CVE-2026-17166

Immediate Actions Required

Update the Event Booking Manager for WooCommerce plugin to the version published in WordPress Change Set 3625494, which supersedes 5.3.7
Review and reset the plugin's payment, cart redirect, checkout login, and confirmation page settings to their intended values
Audit all contributor, author, and editor accounts and remove any that are unrecognized or inactive

Patch Information

The vendor addressed the missing authorization check in the changeset referenced above. The fix adds capability enforcement to the settings handlers in admin/settings/global/admin_setting_panel.php. Site administrators should install the fixed release from the WordPress plugin repository and confirm the plugin version is greater than 5.3.7.

Workarounds

Restrict contributor and author account creation until the plugin is updated
Place the WordPress admin area behind an authenticated reverse proxy or IP allowlist to limit reachability of the vulnerable handler
Deploy a Web Application Firewall rule blocking POST requests to admin_setting_panel.php from sessions lacking administrator capabilities
Temporarily deactivate the plugin if patching is not immediately possible

bash

# Verify installed plugin version via WP-CLI and update
wp plugin get mage-eventpress --field=version
wp plugin update mage-eventpress
wp plugin get mage-eventpress --field=version