CVE-2026-16062mediumCWE-502

CVE-2026-16062: medium-severity vulnerability in Event Booking Manager for WooCommerce

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

Published · Updated

Follow this CVE+ Monitor Event Booking Manager for WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.6epss 0.6%
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is present via another installed Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7's earlier object-injection advisories.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Event Booking Manager for WooCommerce
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Event Booking Manager for WooCommerce

In the same product, most dangerous first.

CVE-2026-91019MEDIUMEvent Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureEPSS 0.4%CVE-2026-91077LOWEvent Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_listEPSS 0.3%CVE-2026-91008LOWEvent Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelEPSS 0.3%CVE-2026-16064MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_eventEPSS 0.2%CVE-2026-16063MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentEPSS 0.2%