CVE-2026-91077— Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list
Quick assessment
Affected
Unknown Event Booking Manager for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce 插件中的 Event Booking Manager 版本低于 5.7.3 时，其事件列表查询未限制为仅请求用户有权读取的事件。因此，具有贡献者级别访问权限及以上的用户可以检索到其他作者的个人私有事件、草稿事件和已删除事件，同时还可以看到标准列表中不显示的事件详情。这会导致隐私信息泄露，暴露出 WordPress 本应对其不具备 权限的用户隐藏的个人私有事件及其内容。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Event Booking Manager for WooCommerce | 5.3.6< 5.7.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91077
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list
Source: CVE Program / CVE List V5
Vulnerability Description
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Event Booking Manager for WooCommerce | 5.3.6 ~ 5.7.3 | - |
|
II. Public POCs for CVE-2026-91077
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91077
请登录查看更多情报信息。
Other References for CVE-2026-91077 (1)
-
https://wpscan.com/vulnerability/9db8d1c4-2bf8-4259-b95f-b131fc385a2e/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-23 · 57 CVEs total
| CVE-2026-86601 | 6.5 MEDIUM | WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Conte |
| CVE-2026-86612 | 5.6 MEDIUM | Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Dat |
| CVE-2026-84091 | 5.3 MEDIUM | SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forge |
| CVE-2026-90950 | 5.3 MEDIUM | Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form |
| CVE-2026-87978 | 5.3 MEDIUM | Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscripti |
| CVE-2026-87071 | 5.3 MEDIUM | Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts |
| CVE-2026-87070 | 5.3 MEDIUM | Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing |
| CVE-2026-86604 | 4.8 MEDIUM | GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation |
| CVE-2026-87848 | 3.7 LOW | MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure |
| CVE-2026-93511 | Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass | |
| CVE-2026-86842 | Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings O | |
| CVE-2026-91024 | Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid) | |
| CVE-2026-89331 | FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Pub | |
| CVE-2026-88997 | JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key | |
| CVE-2026-87981 | Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and | |
| CVE-2026-87074 | Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attac | |
| CVE-2026-87979 | Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via W | |
| CVE-2026-88929 | Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure | |
| CVE-2026-87069 | Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe | |
| CVE-2026-86783 | PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API |
Showing top 20 of 57 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Event Booking Manager for WooCommerce
-
CVE-2026-91019
Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ -
CVE-2026-91008
Event Booking Manager for WooCommerce < 5.3.8 - Unauthentica -
CVE-2026-16064
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ -
CVE-2026-16062
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ -
CVE-2026-16063
Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stor
Same vendor: Unknown
-
CVE-2026-105190
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Cre -
CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ W -
CVE-2026-103517
Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated -
CVE-2026-104671
TutorStarter < 4.0.4 - Unauthenticated User Registration Byp -
CVE-2026-94245
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ A
V. Comments for CVE-2026-91077
No comments yet