CVE-2026-16064: Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16064?
CVE-2026-16064 has a risk score of 48, indicating it is a vulnerability that can lead to unauthorized post modifications.
How do I fix CVE-2026-16064?
To fix CVE-2026-16064, update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later.
Who can exploit CVE-2026-16064?
CVE-2026-16064 can be exploited by users with the Contributor role and above due to improper authorization checks.
What type of modification can be performed due to CVE-2026-16064?
CVE-2026-16064 allows unauthorized users to modify the title and publication status of events.
What software is affected by CVE-2026-16064?
CVE-2026-16064 affects the Event Booking Manager for WooCommerce plugin prior to version 5.3.7.