CVE-2026-91008

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.8

Description The plugin fails to perform ownership or authorization checks before rendering booking confirmation details. This allows unauthenticated attackers to retrieve personal information of registered attendees, including full names, email addresses, phone numbers, and custom registration fields, by providing an enumerable booking reference. This issue only affects sites configured to use the native (non-WooCommerce) checkout, which is not the default setting.

Recommendations Update to version 5.3.8 or later.