Event Booking Manager for WooCommerce <= 5.7.12 - Unauthenticated Event Password Protection Bypass via Booking, RSVP and Enquiry Endpoints
- ID
- WPSEC-2026-2770
- Plugin
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (mage-eventpress)
- Affected
- all versions before 5.7.13
- Remediation
- Update to 5.7.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-284
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Event Booking Manager for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to an access control bypass via its public booking paths (the get_mpwem_ticket and get_mpwem_time AJAX actions, the mep_submit_rsvp and mep_submit_enquiry AJAX actions, WooCommerce add-to-cart validation, native checkout and the [event-add-cart-section] shortcode) in all versions up to, and including, 5.7.12, due to these paths not checking whether an event is password protected. The enquiry handler also does not check whether an event is published or limited to members. This makes it possible for unauthenticated attackers to retrieve the ticket booking panel and ticket prices of password-protected events and to book, RSVP to or send enquiries about those events without knowing the password. They can also send enquiries about unpublished or member-only events.
References
- https://wpsec.com/vuln/WPSEC-2026-2770/
- https://plugins.svn.wordpress.org/mage-eventpress/tags/5.7.13/
- https://wordpress.org/plugins/mage-eventpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS