CVE-2026-17166: magepeopleteam event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendar Missing Authorization

Vulnerability summary

CVE-2026-17166 is a medium (CVSS 4.3) Missing Authorization vulnerability in magepeopleteam event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendar. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.3% of scored vulnerabilities. Fixed in 5.3.8.

Timeline

1. 29-07-2026
   PublishedVulnerability first disclosed.
2. 29-07-2026
   Last modifiedVulnerability information updated.

Description

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.