CVE-2026-16064: WooCommerce Event Booking Auth Bypass

CVE-2026-16064 Overview

CVE-2026-16064 affects the Event Booking Manager for WooCommerce WordPress plugin in versions before 5.3.7. The plugin fails to verify authorization on the object being modified during quick-edit operations. It only checks a global capability instead of per-object ownership. Authenticated users with the Contributor role or higher can modify the title and publication status of arbitrary posts and pages, including content they do not own. The flaw maps to CWE-863: Incorrect Authorization. This is a broken access control issue affecting site content integrity.

Critical Impact
Contributors and higher-privileged users can alter titles and publish or unpublish arbitrary WordPress posts and pages across the site.

Affected Products

Event Booking Manager for WooCommerce WordPress plugin versions prior to 5.3.7
WordPress sites running the vulnerable plugin with Contributor-level or higher user accounts
WooCommerce-based e-commerce sites using the plugin for event bookings

Discovery Timeline

2026-08-02 - CVE-2026-16064 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16064

Vulnerability Analysis

The plugin exposes a quick-edit handler that permits authenticated users to update event post attributes. The handler validates only a global WordPress capability rather than verifying that the caller owns or has rights to the specific object being modified. As a result, any user holding the required capability, which Contributors and higher roles possess, can supply an arbitrary post ID and alter attributes on posts and pages outside their scope.

Attackers can change post titles and toggle publication status. This enables content defacement, unauthorized publication of drafts, or hiding of published pages by reverting them to draft. The impact remains bounded to title and status fields exposed by the quick-edit endpoint.

Root Cause

The root cause is a missing per-object authorization check. The plugin's server-side handler relies on current_user_can() checks against a broad capability without invoking a check bound to the target post ID, such as current_user_can('edit_post', $post_id). This pattern is a classic Broken Access Control failure classified under CWE-863.

Attack Vector

Exploitation requires an authenticated session with at least Contributor privileges. The attacker submits a crafted quick-edit request to the plugin endpoint referencing an arbitrary post or page ID. The server processes the request without validating ownership and updates the target object's title and status fields. Full technical details are available in the WPScan Vulnerability Report.

No public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-16064

Indicators of Compromise

Unexpected changes to post or page titles authored by administrators or editors
Posts transitioning between publish and draft states without corresponding admin activity
WordPress audit log entries showing Contributor-level users modifying posts they do not own
Quick-edit AJAX requests to plugin endpoints referencing post IDs outside the caller's authored content

Detection Strategies

Review the wp_posts table for recent post_modified timestamps that do not align with legitimate editorial workflows
Correlate WordPress user activity logs with post revision history to identify unauthorized title or status changes
Enable a WordPress audit logging plugin to capture per-user post modification events with object IDs
Inspect web server access logs for admin-ajax.php requests carrying the plugin's quick-edit action originating from low-privileged sessions

Monitoring Recommendations

Alert on any post status transition performed by a user whose role is Contributor or Author against posts they did not author
Monitor for bulk or rapid quick-edit requests from a single authenticated session
Track newly created low-privilege accounts that immediately trigger quick-edit actions

How to Mitigate CVE-2026-16064

Immediate Actions Required

Upgrade Event Booking Manager for WooCommerce to version 5.3.7 or later on all affected WordPress sites
Audit existing Contributor, Author, and Editor accounts and remove any that are unnecessary
Review recent post and page modifications to identify unauthorized changes and restore content from revisions where needed
Enforce strong passwords and multi-factor authentication for all authenticated WordPress accounts

Patch Information

The vendor addressed the flaw in Event Booking Manager for WooCommerce version 5.3.7 by adding per-object authorization checks in the quick-edit handler. Site administrators should apply the update through the WordPress plugin dashboard. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the Event Booking Manager for WooCommerce plugin until the patched version is deployed
Restrict the Contributor role using a capability-management plugin to prevent access to the vulnerable quick-edit action
Place the WordPress admin area behind an IP allowlist or a web application firewall rule that blocks anonymous or low-privilege access to the plugin's AJAX endpoints

bash

# Verify installed plugin version using WP-CLI
wp plugin get event-booking-manager-for-woocommerce --field=version

# Update the plugin to the patched release
wp plugin update event-booking-manager-for-woocommerce --version=5.3.7