CVE-2026-16062

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.7

Description Users with Contributor-level access and above can inject PHP objects because the plugin fails to prevent the deserialization of user-controlled input within certain event content fields. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) exists within the plugin itself, the presence of one in another installed plugin could enable arbitrary file deletion, sensitive data retrieval, or remote code execution.

Recommendations Update to version 5.3.7 or later.