EUVD-2026-51950
GHSA-5hqh-mj83-f2f6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L confirmed because a Contributor account is required; C:L retained as publishing private drafts constitutes minor information disclosure; A:N as no availability impact is described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.
AnalysisAI
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. A publicly available proof-of-concept exists; however, no confirmed active exploitation has been identified and the EPSS score sits at 0.13%, indicating limited real-world adversary interest at time of analysis.
Technical ContextAI
The vulnerability resides in CWE-863 (Incorrect Authorization), a failure of object-level access control rather than role-level access control. WordPress implements a capability-based permission model: plugins must check both the user's global capability (e.g., edit_posts) AND that the user has permission to act on the specific object (e.g., via current_user_can('edit_post', $post_id)). This plugin's quick-edit AJAX handler performs only the former check, skipping the per-object ownership verification. The affected CPE is cpe:2.3:a:unknown:event_booking_manager_for_woocommerce:*:*:*:*:*:*:*:*, covering all versions of the plugin in the WordPress ecosystem. The WooCommerce dependency means this plugin is deployed on e-commerce sites running event management functionality, narrowing the exposure to a specific installation profile rather than all WordPress sites.
RemediationAI
Update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later, which introduces proper per-object authorization checks in the quick-edit handler. The patch is available through the WordPress plugin repository; update via the WordPress admin dashboard or WP-CLI (wp plugin update event-booking-manager-for-woocommerce). The WPScan advisory at https://wpscan.com/vulnerability/881ba365-b2ce-41e1-92bb-e5fa275f8a06/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-16064 provide additional context. If immediate patching is not possible, a targeted compensating control is to audit and reduce the number of users holding the Contributor role or above, particularly any accounts with open self-registration. Site administrators can also temporarily disable the quick-edit event functionality via a mu-plugin hook, though this removes a core plugin feature. Neither workaround eliminates the underlying flaw - patching to 5.3.7 is the definitive fix.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows au
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) pe
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated Word
Unauthenticated attackers can retrieve registered attendees' personal information-including full names, email addresses,
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today