CVE-2026-17166: WooCommerce Event Booking Manager Missing Authorization to Modify Payment Settings

Vulnerability Overview Vulnerability Name: Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action CVE ID: CVE-2026-17166 CVSS Score: 4.3 (Medium) Release Date: July 28, 2026 Last Updated Date: July 29, 2026 Researchers: Wordfence PRISM - Wordfence Affected Scope Software Type: Plugin Software Name: Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar Affected Versions: <= 5.3.7 Fixed Version: 5.3.8 Remediation Remediation Measure: Update to version 5.3.8 or a later patched version Additional Information Vulnerability Description: The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings – including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses – that govern how all event bookings are processed. Reference Links plugins.trac.wordpress.org Sharing Options Facebook Twitter LinkedIn Email Recent Vulnerabilities List of multiple related vulnerabilities, including title, CVE ID, CVSS score, researcher, and date. Copyright Information Contains copyright information for Defiant Inc. and The MITRE Corporation. Contact Information Provides contact email and business hours information. Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook YouTube Instagram Products and Support Lists various products and services offered by Wordfence. News and Updates Provides options to subscribe to news and updates. About Detailed information about Wordfence, including affiliate program, employment, contact, security, and CVE request form. Footer Copyright Information: © 2012-2026 Defiant Inc. All Rights Reserved Summary This page provides a detailed description of a vulnerability in the Event Booking Manager for WooCommerce plugin, offering specific vulnerability details, affected scope, remediation measures, reference links, and a list of recent vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-17166: WooCommerce Event Booking Manager Missing Authorization to Modify Payment Settings

More from this source