# CVE-2026-17166: MagePeople Event Booking Manager for WooCommerce authorization bypass

Source: https://junglewise.ai/threats/cve-2026-17166-magepeople-event-booking-manager-for-woocommerce-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-17166 · Severity: medium · CVSS 4.3 · Published 2026-07-29

The Event Booking Manager for WooCommerce plugin for WordPress, which handles ticket sales and event registrations, contains a security flaw that allows unauthorized users to change payment settings. An attacker with basic contributor-level access can modify how the site processes payments, including changing checkout requirements and ticket status settings. This could disrupt business operations, interfere with revenue collection, or redirect customers during the checkout process.

Technologies: [MagePeople Team Event Booking Manager for WooCommerce](https://junglewise.ai/threats/technologies/event-booking-manager-for-woocommerce). Vendors: [MagePeople Team](https://junglewise.ai/threats/vendors/magepeople-team).

## Quick answers

**Is CVE-2026-17166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17166 being exploited in the wild.

**How severe is CVE-2026-17166?** Medium severity, with a CVSS score of 4.3, published 29 July 2026.

**Which products and versions are affected?** MagePeople Team Event Booking Manager for WooCommerce up to, and including, 5.3.7.

**Is there a fix for CVE-2026-17166?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-17166 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-17166?** Check whether you run MagePeople Team Event Booking Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in all versions up to and including 5.3.7. The vulnerability exists within the global settings panel where the plugin fails to properly verify user permissions before allowing updates to sensitive configuration options. An authenticated attacker with contributor-level permissions or higher can exploit this to modify site-wide payment settings, including WooCommerce payment enablement, cart redirect behavior, and ticket confirmation statuses. This is a network-based attack that does not require user interaction. A patch is expected in versions following 5.3.7.

## Affected products

- MagePeople Team Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar up to, and including, 5.3.7

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory

## References

- [https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php](https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php)
- [https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php](https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php)
- [https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php](https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php)
- [https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php](https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php)
- [https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php](https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php)
- [https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php](https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3625494%40mage-eventpress&new=3625494%40mage-eventpress](https://plugins.trac.wordpress.org/changeset?reponame=&old=3625494%40mage-eventpress&new=3625494%40mage-eventpress)