CVE-2026-91008 is an authorization bypass vulnerability in the Event Booking Manager for WooCommerce WordPress plugin prior to version 5.3.8. The plugin fails to verify ownership or authorization before displaying booking confirmation details, enabling unauthenticated attackers to enumerate booking references and retrieve sensitive attendee data such as full name, email, phone number, and custom registration fields. Exploitation is limited to configurations using the plugin's native checkout rather than WooCommerce's default checkout.

An attacker can retrieve personal information of registered attendees without authentication by enumerating booking references. This exposure includes sensitive data like full names, email addresses, phone numbers, and custom registration fields. The impact is limited to sites using the plugin's native checkout, reducing the attack surface but still posing a privacy risk.

Upgrade the Event Booking Manager for WooCommerce plugin to version 5.3.8 or later, where this authorization bypass vulnerability is fixed. Sites using the default WooCommerce checkout are not affected. No other mitigation is necessary if the plugin is updated.