# CVE-2026-91008: Event Booking Manager for WooCommerce privilege escalation

Source: https://junglewise.ai/threats/cve-2026-91008-event-booking-manager-for-woocommerce-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91008 · Severity: low · CVSS 3.7 · Published 2026-09-17

The Event Booking Manager for WooCommerce is a WordPress plugin used to manage event registrations and attendee bookings. The plugin contains an authorization flaw that allows unauthenticated attackers to retrieve sensitive attendee personal information (names, email addresses, phone numbers, and custom fields) by guessing or enumerating booking reference numbers. This exposure is limited to sites using the plugin's custom checkout process rather than the standard WooCommerce checkout.

## Quick answers

**Is CVE-2026-91008 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91008 being exploited in the wild.

**How severe is CVE-2026-91008?** Low severity, with a CVSS score of 3.7, published 17 September 2026.

**Which products and versions are affected?** mage-eventpress Event Booking Manager for WooCommerce before 5.3.8.

**Is there a fix for CVE-2026-91008?** A patch was published on 2026-09-15: Version 5.3.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91008 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91008?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an Insecure Direct Object Reference (IDOR) vulnerability in the booking confirmation panel. The plugin fails to verify ownership or authorization before rendering booking details, allowing an unauthenticated attacker to access PII by supplying an enumerable booking reference parameter. The vulnerability is a broken access control issue (CWE-639) that requires no authentication and can be exploited via simple HTTP requests to the confirmation endpoint. Exploitation is practical only on sites configured to use the plugin's native checkout instead of WooCommerce's standard checkout (non-default configuration). The vulnerability is fixed in version 5.3.8 and later.

## Affected products

- mage-eventpress Event Booking Manager for WooCommerce before 5.3.8

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: patched: Version 5.3.8 released

## References

- [https://wpscan.com/vulnerability/f3bcee4d-06b8-40bd-a4e6-91c671f405c6/](https://wpscan.com/vulnerability/f3bcee4d-06b8-40bd-a4e6-91c671f405c6/)