Threat database

Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.

CVE-2026-107425 is a missing authorization vulnerability in Magepeople inc.'s Bus Ticket Booking with Seat Reservation software. It affects versions from the initial release up to 5.9.7. The flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity and availability. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

CVE-2026-95589 is a missing authorization vulnerability in Magepeople inc.'s Deposits and Partial Payments for WooCommerce plugin. It affects versions from initial release up to but not including 4.0.12. The flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 6.5.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.

CVE-2026-81761 is a medium severity vulnerability in Magepeople inc.'s WpEvently plugin versions up to 5.5.0. It involves broken access control where subscribers can perform unauthorized actions due to missing authorization checks.

CVE-2026-81759 is a medium severity vulnerability in Magepeople inc.'s WpEvently plugin, version 5.5.0 and earlier. It involves broken access control (CWE-862), allowing users with limited privileges to perform unauthorized actions. The vulnerability does not impact confidentiality but can affect integrity and availability. No patch or official remediation guidance is currently available.

CVE-2026-78258 is a medium severity vulnerability in Magepeople inc.'s Booking and Rental Manager software versions up to 2.7.5. It involves missing authorization controls, allowing unauthenticated users to access restricted functionality or data. The vulnerability does not impact integrity or availability, only confidentiality to a limited extent.

CVE-2026-45441 is a high-severity vulnerability in Magepeople inc.'s WpEvently plugin affecting versions up to and including 5.3.3. It involves improper validation of specified quantity in input, classified under CWE-1284. The vulnerability can be exploited without authentication and does not impact confidentiality or availability but can cause a high integrity impact. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.

Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through 4.1.2.

CVE-2026-25426 is a missing authorization vulnerability in Magepeople inc. 's Taxi Booking Manager for WooCommerce plugin. It allows unauthorized users to exploit improperly configured access control, potentially leading to unauthorized access to certain functionality or data. The vulnerability affects versions up to 2.0.1. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.

CVE-2026-25444 is a missing authorization vulnerability in Magepeople inc. 's WpBookingly plugin, affecting versions up to 1.2.9. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 4.3, indicating a medium severity level. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits have been reported in the wild.