User enumeration in the Events Booking extension for Joomla allows an unauthenticated attacker to retrieve account usernames and email addresses via publicly accessible endpoints. This information‑exposure vulnerability (CWE‑200) gives the attacker the ability to compile a list of users, which can be used for targeted phishing, password‑guessing attacks, or profiling, thereby compromising account confidentiality on the website.

Developers and administrators running the Events Booking extension from joomdonation.com for Joomla are affected if their installation is any version earlier than 5.8.0. Version 5.8.0 and later contain a fix that removes the enumeration capability.

The CVSS score of 5.3 signals moderate severity. An EPSS score of less than 1 % indicates a very low likelihood of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated request to a public endpoint exposed by the extension (such as its registration or API page) that returns user details in its response. Remediation requires preventing such requests from revealing account information.