{
 "id": "WPSEC-2026-1482",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1482/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1482/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1482/index.md",
 "title": "Event Manager and Tickets Selling Plugin for WooCommerce <= 5.7.9 - Unauthenticated Missing Authorization to Member-Only and Unpublished Event Registration via RSVP, Native Checkout and Add-to-Cart",
 "description": "The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access via the RSVP submission AJAX action (mep_submit_rsvp), the native checkout AJAX action (mep_native_checkout) and WooCommerce add-to-cart validation in all versions up to, and including, 5.7.9. This is due to the event's \"Member Only\" restriction being enforced only by hiding the booking form on the event page, and to the RSVP and native checkout handlers not checking that the event is published. This makes it possible for unauthenticated attackers to register or book tickets for events limited to specific user roles, and for draft or private events, bypassing the restrictions set by the site owner. For online events, the resulting confirmation emails also give the attacker the virtual meeting link and join details meant only for members.",
 "plugin": {
  "slug": "mage-eventpress",
  "name": "Event Manager and Tickets Selling Plugin for WooCommerce",
  "full_name": "Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar",
  "wordpress_org": "https://wordpress.org/plugins/mage-eventpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mage-eventpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mage-eventpress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.7.10",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.7.10"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.7.10",
 "remediation": "Update to 5.7.10 or later.",
 "fix_released": "2026-10-22T02:57:30+00:00",
 "published": "2026-10-23T03:46:10+00:00",
 "updated": "2026-10-22T09:33:03.608730+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1482/",
  "https://plugins.svn.wordpress.org/mage-eventpress/tags/5.7.10/",
  "https://wordpress.org/plugins/mage-eventpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mage-eventpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}