Quick answers
- Is CVE-2026-91019 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-91019 being exploited in the wild.
- How severe is CVE-2026-91019?
- Medium severity, with a CVSS score of 4.9, published 17 September 2026.
- Which products and versions are affected?
- mage Event Booking Manager for WooCommerce before 5.6.0.
- Is there a fix for CVE-2026-91019?
- A patch was published on 2026-09-17: Version 5.6.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-91019 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-91019?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control (CWE-284) flaw in the plugin's payment gateway configuration interface. The affected component fails to enforce proper authorization checks when retrieving stored credentials for PayPal and Stripe. An authenticated attacker with Contributor or higher role (a low privilege level in WordPress) can make requests to view or export the stored payment gateway configuration, which includes plaintext secret API keys. No network-level authentication bypass is required—exploitation requires only valid WordPress account credentials at a low privilege level. The vendor patched this in version 5.6.0 by implementing proper role-based access controls.
Affected products
- mage Event Booking Manager for WooCommerce before 5.6.0
Timeline
- 2026-09-15: disclosed
- 2026-09-17: patched: Version 5.6.0 released