UNKNOWN NVD

CVE-2026-91019

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

References

https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/

Published: 2026-09-17 · Source: NVD · Feed updated: 2026-09-17

This unknown severity vulnerability was published on 2026-09-17 via NVD.

vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.