Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection

mediumseverity

6.6CVSS score

2.2%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Event Booking Manager for WooCommerce WordPress plugin <= 5.3.6 contains an insecure deserialization vulnerability caused by deserialization of user-controlled input in event content fields, letting users with Contributor-level access inject PHP objects, potentially leading to arbitrary file deletion, data retrieval, or remote code execution if a POP chain is present.

Impact

Users with Contributor access can inject objects leading to file deletion, data exposure, or remote code execution if a POP chain exists.

Fix

Upgrade to version 5.3.7 or later.

How to confirm it

Send: GET /wp-content/plugins/mage-eventpress/readme.txt
Positive when: status_code == 200 and compare_versions(mepversion, "<= 5.3.6")
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/post-new.php?post_type=mep_events
Positive when: status_code == 200 and contains_all(body, "name=\"mep_enable_recurring\"", "_mpwem_edit_nonce", "mpwem_event_edit_save")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "\"success\":false", "Invalid or unpublished Event.")

Run it with nuclei: nuclei -id CVE-2026-16062 -u <target>

The full check

id: CVE-2026-16062

info:
  name: Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection
  author: yaswanth77,0x_Akoko
  severity: medium
  description: |
    Event Booking Manager for WooCommerce WordPress plugin <= 5.3.6 contains an insecure deserialization vulnerability caused by deserialization of user-controlled input in event content fields, letting users with Contributor-level access inject PHP objects, potentially leading to arbitrary file deletion, data retrieval, or remote code execution if a POP chain is present.
  impact: |
    Users with Contributor access can inject objects leading to file deletion, data exposure, or remote code execution if a POP chain exists.
  remediation: |
    Upgrade to version 5.3.7 or later.
  reference:
    - https://wpscan.com/vulnerability/2e2bc528-0f06-4d99-8597-1f8a0fd57b39
    - https://plugins.trac.wordpress.org/changeset?old_path=/mage-eventpress/tags/5.3.6&new_path=/mage-eventpress/tags/5.3.7
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16062
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 6.6
    cve-id: CVE-2026-16062
    epss-score: 0.02164
    epss-percentile: 0.82383
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 4
    vendor: magepeopleteam
    product: mage-eventpress
    shodan-query: http.html:"/wp-content/plugins/mage-eventpress/"
    fofa-query: body="/wp-content/plugins/mage-eventpress/"
  tags: cve,cve2026,wp,wordpress,wp-plugin,mage-eventpress,authenticated,intrusive

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        GET /wp-content/plugins/mage-eventpress/readme.txt HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: mepversion
        internal: true
        part: body
        group: 1
        regex:
          - '(?s)==\s*Changelog\s*==.*?=\s*([0-9][0-9.]*)\s*='

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'compare_versions(mepversion, "<= 5.3.6")'
        condition: and

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and

  - raw:
      - |
        GET /wp-admin/post-new.php?post_type=mep_events HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "name=\"mep_enable_recurring\"", "_mpwem_edit_nonce", "mpwem_event_edit_save")'
        condition: and

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=get_mpwem_ticket&post_id=99999999&dates=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"success\":false", "Invalid or unpublished Event.")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from