CVE-2026-16062 Details

A PHP object injection vulnerability has been identified in the Event Booking Manager for WooCommerce WordPress plugin, affecting versions prior to 5.3.7. The vulnerability arises because the plugin does not adequately prevent the deserialization of user-controlled input in certain event content fields. This flaw allows users with Contributor-level access and above to inject PHP objects. While the plugin itself does not contain a proof-of-concept chain, the injected objects could be exploited if a chain is present through another installed Event Booking Manager for WooCommerce plugin or theme. Potential consequences of such exploitation include arbitrary file deletion, unauthorized retrieval of sensitive data, or remote code execution. This vulnerability represents an incomplete fix of the plugin's earlier object-injection advisories.