Junglewise Threat Intelligence

CVE-2026-17166: MagePeople Event Booking Manager for WooCommerce authorization bypass

CVE-2026-17166 · Severity: medium · CVSS 4.3 · Published 2026-07-29

Technologies: MagePeople Team Event Booking Manager for WooCommerce. Vendors: MagePeople Team.

Executive brief

The Event Booking Manager for WooCommerce plugin for WordPress, which handles ticket sales and event registrations, contains a security flaw that allows unauthorized users to change payment settings. An attacker with basic contributor-level access can modify how the site processes payments, including changing checkout requirements and ticket status settings. This could disrupt business operations, interfere with revenue collection, or redirect customers during the checkout process.

Technical details

The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in all versions up to and including 5.3.7. The vulnerability exists within the global settings panel where the plugin fails to properly verify user permissions before allowing updates to sensitive configuration options. An authenticated attacker with contributor-level permissions or higher can exploit this to modify site-wide payment settings, including WooCommerce payment enablement, cart redirect behavior, and ticket confirmation statuses. This is a network-based attack that does not require user interaction. A patch is expected in versions following 5.3.7.

Affected products

  • MagePeople Team Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar up to, and including, 5.3.7

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: advisory

References