EUVD-2026-51948
GHSA-xh9j-gpmv-5c2v
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Contributor access maps to PR:L not PR:H; AC:H retained because exploitation requires a co-installed POP-chain gadget, a non-default condition.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is present via another installed Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7's earlier object-injection advisories.
AnalysisAI
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes the root cause: the plugin passes user-supplied input from event content fields directly into PHP's unserialize() or an equivalent mechanism without sanitization or allowlist validation. PHP deserialization is inherently dangerous because any class currently loaded in memory can participate in a POP chain - a sequence of magic method calls (__wakeup, __destruct, __toString, etc.) that, when chained across multiple objects, executes attacker-controlled logic. The affected CPE is cpe:2.3:a:unknown:event_booking_manager_for_woocommerce:*:*:*:*:*:*:*:* covering all releases prior to 5.3.7. Because WordPress sites aggregate many plugins, the attack surface for co-installed POP chains is non-trivial: common libraries such as Monolog, Guzzle, or Symfony components bundled by other plugins frequently supply viable gadgets.
RemediationAI
Update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later immediately, as this is the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/2e2bc528-0f06-4d99-8597-1f8a0fd57b39/. Given that this is an incomplete fix of prior advisories, verify that the installed version is exactly 5.3.7 or newer - intermediate patch releases may not fully address the deserialization surface. As compensating controls where patching is delayed: restrict Contributor-level account creation and audit existing contributor accounts for legitimacy, since exploitation requires at minimum that privilege. Additionally, audit co-installed plugins for known POP-chain gadgets using tools such as phpggc; removing or updating gadget-supplying plugins eliminates the exploitation prerequisite even if the deserialization flaw remains. Disabling the event content submission feature for untrusted roles, if the plugin exposes such a toggle, would neutralize the injection point without requiring a full update.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today