{"id":"CVE-2026-91019","title":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe…","summary":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-284"],"product":"Event Booking Manager for WooCommerce","affected":["event_booking_manager_for_woocommerce >= 5.3.6 < 5.6.0"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:08:32.830","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91019","references":[{"url":"https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.00222,"epssPercentile":0.13041,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T12:10:04.134288Z"},"ingestedAt":"2026-09-17T06:12:17.969Z","slug":"CVE-2026-91019","body":"## Overview\n\nThe Event Booking Manager for WooCommerce  WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":206081,"id":"CVE-2026-91019","ts":1789651153863,"field":"cvss","old":null,"new":"4.9"},{"seq":206080,"id":"CVE-2026-91019","ts":1789651153863,"field":"severity","old":"none","new":"medium"}]}