CVE-2026-91019 — Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

CVE-2026-91019

Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure PUBLISHED

Description (CNA)

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

Affected (CNA)

Vendor / product	Versions
Unknown / Event Booking Manager for WooCommerce	affected 5.3.6 before 5.6.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.