WordPress Plugin Vulnerabilities

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.6.4 - Unauthenticated Insecure Direct Object Reference

Description

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
mage-eventpress
Fixed in 5.6.4

References

CVE
CVE-2026-81802
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/04ee71cb-500c-4685-b26d-1460dee7c759

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
benzdeus
Verified
No
WPVDB ID
cdc9b0f0-9b7e-4714-a562-f5eb5e536f04

Timeline

Publicly Published
2026-09-07 (about 1 month ago)
Added
2026-09-10 (about 1 month ago)
Last Updated
2026-09-10 (about 1 month ago)

Other

Published
Title
Published
2026-08-26
Title
Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR
Published
2026-07-02
Title
MotoPress Appointment Booking < 2.4.5 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
Published
2025-05-06
Title
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation
Published
2026-09-03
Title
Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR
Published
2026-08-11
Title
Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR