EUVD-2026-51950
GHSA-5hqh-mj83-f2f6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L confirmed because a Contributor account is required; C:L retained as publishing private drafts constitutes minor information disclosure; A:N as no availability impact is described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.
AnalysisAI
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows any authenticated user with the Contributor role or higher to modify the title and publication status of arbitrary posts and pages sitewide - including content they do not own. The plugin's quick-edit event handler validates only a global WordPress capability (e.g., edit_posts) without confirming whether the requesting user owns the target object, enabling horizontal and vertical privilege escalation over site content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated WordPress user account with at minimum the Contributor role on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 5.4 (Medium) reflects network reachability (AV:N), low complexity (AC:L), and low-privilege requirement (PR:L) with limited integrity and confidentiality impact (I:L, C:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or registered a Contributor-level WordPress account on a target site with the plugin installed sends a crafted AJAX quick-edit request specifying the ID of a private draft or page owned by an administrator or another user. Because the plugin only validates the global edit_posts capability - which Contributors possess - the request succeeds, allowing the attacker to retitle the content or publish previously private drafts, potentially exposing confidential information or defacing public-facing pages. … |
| Remediation | Update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later, which introduces proper per-object authorization checks in the quick-edit handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows au
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) pe
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today