CVE-2026-17166

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.8

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can modify site-wide payment settings that control how event bookings are processed. This includes altering WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses. The issue is triggered via the mep save payment settings modal AJAX action.

Recommendations Update to a version newer than 5.3.7. As a temporary mitigation, restrict user roles to prevent contributors from accessing the mep save payment settings modal AJAX action.