The Event Booking Manager for WooCommerce plugin before 5.7.3 fails to enforce read permissions on its event listing query. Contributors and higher privileges can fetch private, draft, and trashed events belonging to other authors, exposing content that WordPress normally protects due to the read_private_posts capability. This weakness is an example of inadequate access control (CWE‑284) and could lead to leakage of sensitive event details.

The vulnerability targets the Event Booking Manager for WooCommerce WordPress plugin versions 5.3.6 through 5.7.2. WordPress sites running any of these plugin releases are at risk, regardless of installation location or additional configuration.

The CVSS score of 2.7 classifies the flaw as low impact, and the EPSS score of less than 1% indicates a very low likelihood of active exploitation. The flaw is not currently listed in the CISA KEV catalog. Attackers would need an authenticated WordPress account with contributor-level permissions or higher and would invoke the mpwem_load_event_list endpoint, which returns event data without enforcing the read_private_posts check. Because the plugin endpoint is exposed over the web, the exploit remains authenticated but does not require a separate vulnerability or privilege escalation.