CVE-2026-16064: medium-severity vulnerability in Event Booking Manager for WooCommerce
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.4epss 0.2%
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Event Booking Manager for WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/881ba365-b2ce-41e1-92bb-e5fa275f8a06/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Event Booking Manager for WooCommerce
In the same product, most dangerous first.
CVE-2026-16062MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentEPSS 0.6%CVE-2026-91019MEDIUMEvent Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureEPSS 0.4%CVE-2026-91077LOWEvent Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_listEPSS 0.3%CVE-2026-91008LOWEvent Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelEPSS 0.3%CVE-2026-16063MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentEPSS 0.2%