PHP Object Injection in Event Booking Manager for WooCommerce < 5.3.7 (CVE-2026-16062)

Vulnerability Overview Vulnerability Name: Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content Vulnerability Type: PHP Object Injection Description: The plugin lacks protection against deserialization of user-controllable inputs, allowing users with Contributor level or higher privileges to inject PHP objects. Although the plugin itself does not contain a POP chain, the presence of a POP chain in other installed plugins or themes could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution. This represents an incomplete fix for a previously reported object injection advisory for this plugin. Affected Scope Affected Plugin: mage-eventpress Affected Versions: Event Booking Manager for WooCommerce < 5.3.7 Remediation Fixed Version: 5.3.7 Additional Information CVE ID: CVE-2026-16062 Classification: - Type: OBJECT INJECTION - OWASP Top 10: A8: Insecure Deserialization - CWE: CWE-502 - CVSS: 6.6 (medium) Original Researcher: Yaswanth Reddy Sunkara Submitter: Yaswanth Reddy Sunkara Verification Status: Yes WPVDB ID: 2e2bc528-0f06-4d99-8597-1f8a0fd57b39 Timeline: - Public Release Date: 2026-07-22 - Date Added: 2026-07-22 - Last Updated: 2026-07-22 Related Vulnerabilities 2025-08-19: White Rabbit <= 1.5.2 - Unauthenticated PHP Object Injection 2025-05-20: Avantage < 2.5.0 - Unauthenticated PHP Object Injection 2024-09-30: Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection 2026-03-25: Frontend Admin by DynamiApps < 3.28.32 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts 2026-04-08: Micdrop < 1.4 - Unauthenticated PHP Object Injection POC Code POC Code: No specific POC code is provided on the page. However, it mentions that the POC will be released on August 19, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

PHP Object Injection in Event Booking Manager for WooCommerce < 5.3.7 (CVE-2026-16062)

More from this source