CVE-2026-91019: Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Event Booking Manager for WooCommerceto a version that resolves this vulnerability.Fixed in 5.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Contributor-level access or a higher role can view the plugin's stored payment gateway configuration. This includes access to PayPal and Stripe credentials, including secret keys.
Which deployments are affected?
Sites using Event Booking Manager for WooCommerce versions earlier than 5.6.0 are affected. The issue concerns stored payment gateway configuration, so exposure depends on whether PayPal or Stripe credentials are configured in the plugin.
What should be done if an affected site may have had Contributor access?
Update the plugin to version 5.6.0 or later. Because exposed data can include PayPal and Stripe secret keys, review who had Contributor-or-higher access and rotate any credentials that may have been accessible.