Event Manager and Tickets Selling Plugin for WooCommerce <= 5.7.9 - Unauthenticated Missing Authorization to Member-Only and Unpublished Event Registration via RSVP, Native Checkout and Add-to-Cart
- ID
- WPSEC-2026-1482
- Plugin
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (mage-eventpress)
- Affected
- all versions before 5.7.10
- Remediation
- Update to 5.7.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Event Manager and Tickets Selling Plugin for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access via the RSVP submission AJAX action (mep_submit_rsvp), the native checkout AJAX action (mep_native_checkout) and WooCommerce add-to-cart validation in all versions up to, and including, 5.7.9. This is due to the event's "Member Only" restriction being enforced only by hiding the booking form on the event page, and to the RSVP and native checkout handlers not checking that the event is published. This makes it possible for unauthenticated attackers to register or book tickets for events limited to specific user roles, and for draft or private events, bypassing the restrictions set by the site owner. For online events, the resulting confirmation emails also give the attacker the virtual meeting link and join details meant only for members.
References
- https://wpsec.com/vuln/WPSEC-2026-1482/
- https://plugins.svn.wordpress.org/mage-eventpress/tags/5.7.10/
- https://wordpress.org/plugins/mage-eventpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS