CVE-2026-91019 Event Booking Manager for WooCommerce CVE debrief

Who should care

Defenders and administrators of WordPress sites using the Event Booking Manager for WooCommerce plugin should assess exposure and take action to restrict access to sensitive configurations.

Why it matters

The Event Booking Manager for WooCommerce WordPress plugin vulnerability allows users with Contributor-level access to read sensitive payment gateway credentials, potentially leading to exposure and misuse.

• Potential exposure of PayPal and Stripe credentials.
• Possible misuse of exposed credentials for financial gain.
• Need for verification of plugin version and access controls.
• Potential impact on site security and data integrity.

Technical summary

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys. This vulnerability can be exploited by users with Contributor-level access, potentially leading to unauthorized access to sensitive payment information. The plugin's failure to restrict access to sensitive configurations allows for potential misuse of exposed credentials.

Defensive priority

Defenders should prioritize verifying exposure and restricting access to sensitive configurations.

Recommended defensive actions

• Verify the version of the Event Booking Manager for WooCommerce WordPress plugin is 5.6.0 or later.
• Restrict access to sensitive configurations, such as payment gateway credentials.
• Monitor for potential misuse of exposed credentials.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor remediation and affected versions require further verification. The vulnerability was disclosed on 2026-09-17, and its details have been sourced from CVE and NVD. However, additional verification is needed to confirm the affected versions and ensure proper remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.