What is GHSA-2pgf-j495-ffj6?

GHSA-2pgf-j495-ffj6 is a security advisory published by GitHub Security Advisories with Medium severity. The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who...

Which CVE IDs does GHSA-2pgf-j495-ffj6 cover?

GHSA-2pgf-j495-ffj6 covers the following CVE IDs: CVE-2026-91019. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2pgf-j495-ffj6?

GHSA-2pgf-j495-ffj6 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-2pgf-j495-ffj6MediumCVSS 4.9

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-91019 →

📋 Description

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-91019
https://wpscan.com/vulnerability/549c3611-934d-4712-83aa-cfe501647e80
https://github.com/advisories/GHSA-2pgf-j495-ffj6