CVE-2026-91008: Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Event Booking Manager for WooCommerce (WordPress plugin)to a version that resolves this vulnerability.Fixed in 5.3.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Only sites using a version earlier than 5.3.8 and configured for the plugin's native, non-WooCommerce checkout are affected. Native checkout is not the default configuration.
What does an attacker need to retrieve attendee information?
No authentication is required. The attacker needs to supply an enumerable booking reference to access booking confirmation details.
What information could be disclosed?
Exposed booking details can include the attendee's full name, email address, phone number, and custom registration fields.
How can I determine whether my site is affected?
Check whether Event Booking Manager for WooCommerce is below version 5.3.8 and whether its native, non-WooCommerce checkout is enabled. Sites not using that checkout mode are outside the stated exploitation conditions.