# Event Manager and Tickets Selling Plugin for WooCommerce <= 5.7.9 - Unauthenticated Missing Authorization to Member-Only and Unpublished Event Registration via RSVP, Native Checkout and Add-to-Cart

- **ID:** WPSEC-2026-1482
- **Plugin:** Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (`mage-eventpress`), https://wordpress.org/plugins/mage-eventpress/
- **Affected versions:** all versions before 5.7.10
- **Fixed in:** 5.7.10 (Update to 5.7.10 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mage-eventpress
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1482/

## Description

The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access via the RSVP submission AJAX action (mep_submit_rsvp), the native checkout AJAX action (mep_native_checkout) and WooCommerce add-to-cart validation in all versions up to, and including, 5.7.9. This is due to the event's "Member Only" restriction being enforced only by hiding the booking form on the event page, and to the RSVP and native checkout handlers not checking that the event is published. This makes it possible for unauthenticated attackers to register or book tickets for events limited to specific user roles, and for draft or private events, bypassing the restrictions set by the site owner. For online events, the resulting confirmation emails also give the attacker the virtual meeting link and join details meant only for members.

## References

- https://wpsec.com/vuln/WPSEC-2026-1482/
- https://plugins.svn.wordpress.org/mage-eventpress/tags/5.7.10/
- https://wordpress.org/plugins/mage-eventpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1482/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.