CVE Explorer

CVE-2026-16064

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a1cbb810251151b82fd8dc815a27b0213add53c44bbd01a35d69f23cca7d3520

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/adp/0/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Event Booking Manager for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"5.3.7","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/adp/0/problemTypes/0/descriptions/0

Source references

1 source assertion

{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/881ba365-b2ce-41e1-92bb-e5fa275f8a06/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24b75b2802a588f56763b06bbc4ddfa74588aae2d9b68e6d5b0c72c46329112c · sha256:80457b7b7cf5028b… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer