CyberRota Analysis
AI-GeneratedThe Event Booking Manager for WooCommerce plugin for WordPress versions prior to 5.3.8 lacks proper ownership and authorization checks, enabling unauthenticated attackers to access sensitive personal information of registered attendees by providing a valid booking reference. This vulnerability primarily affects sites using the plugin's native checkout system, which is not the default configuration. WordPress site administrators utilizing this plugin should prioritize updating to the latest version to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.