The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and abov…

Info

CVECVE-2026-91019

First seen2026-09-17 07:15 UTC

Disclosed2026-09-17 06:16 UTC

Last updated2026-09-17 07:15 UTC

Channel statusauto

Summary

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/

Timeline

2026-09-17 nvd_ingest NVD