What is GHSA-vc5f-85m8-x67v?

GHSA-vc5f-85m8-x67v is a security advisory published by GitHub Security Advisories with Low severity. The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an...

Which CVE IDs does GHSA-vc5f-85m8-x67v cover?

GHSA-vc5f-85m8-x67v covers the following CVE IDs: CVE-2026-91008. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vc5f-85m8-x67v?

GHSA-vc5f-85m8-x67v has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-vc5f-85m8-x67vLowCVSS 3.7

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-91008 →

📋 Description

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-91008
https://wpscan.com/vulnerability/f3bcee4d-06b8-40bd-a4e6-91c671f405c6
https://github.com/advisories/GHSA-vc5f-85m8-x67v