# Event Booking Manager for WooCommerce <= 5.7.12 - Unauthenticated Event Password Protection Bypass via Booking, RSVP and Enquiry Endpoints

- **ID:** WPSEC-2026-2770
- **Plugin:** Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (`mage-eventpress`), https://wordpress.org/plugins/mage-eventpress/
- **Affected versions:** all versions before 5.7.13
- **Fixed in:** 5.7.13 (Update to 5.7.13 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mage-eventpress
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2770/

## Description

The Event Booking Manager for WooCommerce plugin for WordPress is vulnerable to an access control bypass via its public booking paths (the get_mpwem_ticket and get_mpwem_time AJAX actions, the mep_submit_rsvp and mep_submit_enquiry AJAX actions, WooCommerce add-to-cart validation, native checkout and the [event-add-cart-section] shortcode) in all versions up to, and including, 5.7.12, due to these paths not checking whether an event is password protected. The enquiry handler also does not check whether an event is published or limited to members. This makes it possible for unauthenticated attackers to retrieve the ticket booking panel and ticket prices of password-protected events and to book, RSVP to or send enquiries about those events without knowing the password. They can also send enquiries about unpublished or member-only events.

## References

- https://wpsec.com/vuln/WPSEC-2026-2770/
- https://plugins.svn.wordpress.org/mage-eventpress/tags/5.7.13/
- https://wordpress.org/plugins/mage-eventpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2770/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.