CyberRota Analysis
AI-GeneratedThe Event Booking Manager for WooCommerce plugin in WordPress versions prior to 5.7.3 is vulnerable due to insufficient access controls, allowing users with contributor-level access and above to access private, draft, and trashed events created by other authors. This vulnerability can lead to unauthorized disclosure of sensitive event information that should be restricted based on user permissions. WordPress site administrators and developers using this plugin should prioritize updating to the latest version to mitigate potential data exposure risks.
Original NVD Description
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.