# CVE-2026-91019: Event Booking Manager for WooCommerce access control bypass in payment gateway configuration

Source: https://junglewise.ai/threats/cve-2026-91019-event-booking-manager-for-woocommerce-access-control-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91019 · Severity: medium · CVSS 4.9 · Published 2026-09-17

The Event Booking Manager for WooCommerce plugin fails to restrict access to stored payment gateway credentials. Any WordPress user with Contributor-level access or higher can view and exfiltrate sensitive PayPal and Stripe API keys, including secret keys used to process transactions. This exposure allows account takeover and unauthorized transaction processing on behalf of the affected business.

## Quick answers

**Is CVE-2026-91019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91019 being exploited in the wild.

**How severe is CVE-2026-91019?** Medium severity, with a CVSS score of 4.9, published 17 September 2026.

**Which products and versions are affected?** mage Event Booking Manager for WooCommerce before 5.6.0.

**Is there a fix for CVE-2026-91019?** A patch was published on 2026-09-17: Version 5.6.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91019 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-91019?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control (CWE-284) flaw in the plugin's payment gateway configuration interface. The affected component fails to enforce proper authorization checks when retrieving stored credentials for PayPal and Stripe. An authenticated attacker with Contributor or higher role (a low privilege level in WordPress) can make requests to view or export the stored payment gateway configuration, which includes plaintext secret API keys. No network-level authentication bypass is required—exploitation requires only valid WordPress account credentials at a low privilege level. The vendor patched this in version 5.6.0 by implementing proper role-based access controls.

## Affected products

- mage Event Booking Manager for WooCommerce before 5.6.0

## Timeline

- 2026-09-15: disclosed
- 2026-09-17: patched: Version 5.6.0 released

## References

- [https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/](https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/)