CVE-2026-91077: WooCommerce Event Booking Manager Disclosure

CVE-2026-91077 Overview

CVE-2026-91077 is a broken access control vulnerability [CWE-284] in the Event Booking Manager for WooCommerce WordPress plugin before version 5.7.3. The plugin fails to restrict its event listing query to events the requesting user is permitted to read. Authenticated users with contributor-level access or higher can retrieve other authors' private, draft, and trashed events. The response also exposes event detail that the standard listing does not display to unauthorized users. This bypasses the WordPress read_private_posts capability check that normally withholds private post content.

Critical Impact
Contributor-level accounts can enumerate and read private, draft, and trashed events belonging to other authors, disclosing content WordPress access controls should hide.

Affected Products

Event Booking Manager for WooCommerce WordPress plugin versions prior to 5.7.3
WordPress sites running the vulnerable plugin with contributor or higher user accounts
WooCommerce environments relying on the plugin for private event workflows

Discovery Timeline

2026-09-23 - CVE-2026-91077 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91077

Vulnerability Analysis

The Event Booking Manager for WooCommerce plugin exposes an event listing query that returns posts without validating the caller's read permissions. WordPress normally restricts private, draft, and trashed posts to users holding the read_private_posts capability or ownership of the post. The plugin bypasses this model by issuing its own query that ignores post status and authorship filters. As a result, any authenticated user at the contributor role or above can retrieve events they should not see. The returned payload also includes event fields that are absent from the standard, permission-aware listing view.

Root Cause

The root cause is missing authorization enforcement in the plugin's event listing handler. The query does not constrain results by post status or ownership and does not verify the requesting user's capabilities. This is a classic broken access control flaw categorized under [CWE-284] (Improper Access Control). See the WPScan Vulnerability Report for the technical breakdown.

Attack Vector

Exploitation requires an authenticated session with contributor-level privileges or higher. The attacker invokes the plugin's event listing endpoint over the network and receives events across all authors and post statuses. No user interaction is required beyond issuing the request. Confidentiality of private, draft, and trashed event content is impacted; integrity and availability are not affected.

Detection Methods for CVE-2026-91077

Indicators of Compromise

Contributor or author accounts issuing requests to the plugin's event listing endpoint at unusual volumes or frequencies.
Application logs showing event listing responses containing post IDs owned by other authors or with private, draft, or trash statuses.
Access patterns from low-privilege sessions that retrieve event fields not present in the normal listing view.

Detection Strategies

Review WordPress access logs for requests to plugin listing endpoints originating from non-admin roles.
Compare returned post IDs against the requesting user's authored posts to flag cross-author disclosure.
Alert on responses that include event fields tied to private post statuses returned to non-privileged users.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform and correlate authenticated user roles with the sensitivity of retrieved data.
Track the count of distinct authors returned per session; a low-privilege user retrieving many authors' posts is anomalous.
Monitor for enumeration behavior against event-related REST or AJAX endpoints exposed by the plugin.

How to Mitigate CVE-2026-91077

Immediate Actions Required

Upgrade the Event Booking Manager for WooCommerce plugin to version 5.7.3 or later on all affected WordPress sites.
Audit existing contributor, author, and editor accounts and remove any that are unnecessary or inactive.
Review recent access logs for signs of unauthorized event enumeration prior to patching.

Patch Information

The vendor addressed the flaw in Event Booking Manager for WooCommerce version 5.7.3. The fix constrains the event listing query so that results respect WordPress capability checks, including read_private_posts, and post authorship. Refer to the WPScan Vulnerability Report for the fixed release reference.

Workarounds

Temporarily restrict contributor-level and above access to the affected sites until the plugin is updated.
Disable the Event Booking Manager for WooCommerce plugin if patching cannot be performed promptly.
Place the WordPress admin and plugin endpoints behind a web application firewall rule that blocks event listing requests from non-privileged roles.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update event-booking-manager-for-woocommerce --version=5.7.3
wp plugin status event-booking-manager-for-woocommerce