Threat database

Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.

CVE-2026-111823 is a critical vulnerability in Mage OSS mage-ai versions up to 0.9.80. The issue involves the software proceeding with session creation even when encountering an unknown OAuth provider, which is a detection of an error condition without appropriate action (CWE-390). This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.

CVE-2026-107425 is a missing authorization vulnerability in Magepeople inc.'s Bus Ticket Booking with Seat Reservation software. It affects versions from the initial release up to 5.9.7. The flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity and availability. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

CVE-2026-95589 is a missing authorization vulnerability in Magepeople inc.'s Deposits and Partial Payments for WooCommerce plugin. It affects versions from initial release up to but not including 4.0.12. The flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 6.5.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

CVE-2026-81761 is a medium severity vulnerability in Magepeople inc.'s WpEvently plugin versions up to 5.5.0. It involves broken access control where subscribers can perform unauthorized actions due to missing authorization checks.

CVE-2026-81759 is a medium severity vulnerability in Magepeople inc.'s WpEvently plugin, version 5.5.0 and earlier. It involves broken access control (CWE-862), allowing users with limited privileges to perform unauthorized actions. The vulnerability does not impact confidentiality but can affect integrity and availability. No patch or official remediation guidance is currently available.

CVE-2026-78257 is a high severity vulnerability involving PHP Object Injection due to deserialization of untrusted data in the Booking and Rental Manager product by magepeopleteam. It affects versions up to and including 2.7.5. The vulnerability allows an attacker with network access and low privileges to execute arbitrary code, causing high impact on confidentiality, integrity, and availability.

CVE-2026-78258 is a medium severity vulnerability in Magepeople inc.'s Booking and Rental Manager software up to version 2.7.5. It is caused by missing authorization controls, which allows unauthenticated users to access restricted functionality or data. The vulnerability impacts confidentiality to a limited extent but does not affect data integrity or availability.