CVE-2026-91019: WooCommerce Event Booking Info Disclosure

CVE-2026-91019 Overview

CVE-2026-91019 is an access control flaw in the Event Booking Manager for WooCommerce WordPress plugin in versions before 5.6.0. The plugin fails to restrict who can view its stored payment gateway configuration. Any authenticated user with Contributor-level access or above can read the site's PayPal and Stripe credentials, including secret keys. The weakness is tracked under CWE-284: Improper Access Control.

Critical Impact
Exposure of Stripe and PayPal secret keys enables attackers to authenticate to payment processor APIs, potentially issuing refunds, viewing transaction data, or impersonating the merchant against the payment provider.

Affected Products

Event Booking Manager for WooCommerce WordPress plugin, all versions prior to 5.6.0
WordPress sites exposing Contributor-level or higher accounts
WooCommerce stores integrated with PayPal or Stripe through this plugin

Discovery Timeline

2026-09-17 - CVE-2026-91019 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91019

Vulnerability Analysis

The plugin stores payment gateway configuration, including PayPal and Stripe API credentials, in a location readable through plugin functionality that lacks capability checks. Rather than restricting credential retrieval to administrators, the plugin exposes gateway settings to any authenticated user starting at the Contributor role. Contributors are low-privilege users who normally can only draft posts, so they should never obtain payment secrets.

Because the exposed data includes Stripe secret keys and PayPal client secrets, an attacker with any writer-level account inherits the ability to authenticate directly against the merchant's payment processor accounts outside the WordPress environment.

Root Cause

The root cause is missing authorization enforcement on the code path that returns stored payment gateway settings. The plugin trusts that only administrators can reach the configuration data, but the underlying handler does not call a WordPress capability check such as current_user_can( 'manage_options' ) before returning secrets. This is a classic [CWE-284] Improper Access Control condition.

Attack Vector

Exploitation requires an authenticated session with Contributor privileges or higher on the target WordPress site. The attack is executed over the network against the WordPress front end or admin interface. No user interaction from an administrator is required. Once the attacker retrieves the credentials, follow-on activity moves off the WordPress site and directly against the PayPal or Stripe APIs. Refer to the WPScan Vulnerability Report for technical specifics.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose above rather than with synthetic code.

Detection Methods for CVE-2026-91019

Indicators of Compromise

Unexpected requests to plugin endpoints handling payment gateway settings originating from non-administrator user sessions.
Unusual API activity in Stripe or PayPal merchant dashboards, including refunds, credential rotations, or webhook changes not initiated by staff.
New or dormant Contributor, Author, or Editor accounts accessing settings pages shortly before payment processor anomalies.

Detection Strategies

Audit WordPress access logs for requests to Event Booking Manager for WooCommerce endpoints performed by non-administrator roles.
Correlate WordPress authentication events with outbound calls to api.stripe.com and api.paypal.com that do not originate from expected server-side workflows.
Review the plugin version reported by the site; any version below 5.6.0 should be treated as vulnerable regardless of observed activity.

Monitoring Recommendations

Enable Stripe and PayPal API-level logging and alerting on key usage from unexpected IP addresses or user agents.
Monitor WordPress role assignments and flag privilege changes that grant Contributor access to unfamiliar accounts.
Ingest web server and WordPress audit logs into a centralized analytics platform to correlate low-privilege user actions with sensitive setting reads.

How to Mitigate CVE-2026-91019

Immediate Actions Required

Update the Event Booking Manager for WooCommerce plugin to version 5.6.0 or later on every affected WordPress installation.
Rotate all PayPal and Stripe API credentials that were configured in the plugin before the update.
Review the WordPress user list and remove or downgrade untrusted Contributor, Author, or Editor accounts.
Inspect payment processor activity logs for unauthorized API calls performed with the exposed keys.

Patch Information

The vendor fixed the issue in Event Booking Manager for WooCommerce version 5.6.0 by restricting access to the stored payment gateway configuration. Full details are available in the WPScan Vulnerability Report.

Workarounds

If updating immediately is not possible, deactivate the Event Booking Manager for WooCommerce plugin until the patched version can be installed.
Temporarily revoke Contributor, Author, and Editor accounts, or restrict them via a role-management plugin so they cannot reach the vulnerable settings.
Rotate PayPal and Stripe credentials and restrict API keys with processor-side IP allowlists where supported.

bash

# Example: update the plugin using WP-CLI
wp plugin update event-booking-manager-for-woocommerce --version=5.6.0

# Verify installed version
wp plugin get event-booking-manager-for-woocommerce --field=version