The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Mon, 03 Aug 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 CWE-285 |
Sun, 02 Aug 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own. | |
| Title | Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2026-08-02T06:00:12.946Z
Updated: 2026-08-02T06:00:12.946Z
Reserved: 2026-07-17T12:58:58.934Z
Link: CVE-2026-16064
Vulnrichment
No data.
NVD
No data.
Redhat
No data.