# CVE-2026-16062: Event Booking Manager for WooCommerce object injection via event content

Source: https://junglewise.ai/threats/cve-2026-16062-event-booking-manager-for-woocommerce-object-injection-via-event  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16062 · Severity: medium · CVSS 6.6 · Published 2026-08-02

Event Booking Manager for WooCommerce is a WordPress plugin for managing event bookings and ticketing. The plugin fails to safely handle serialized data in event timeline and FAQ content fields, allowing contributors and higher-level users to inject malicious PHP objects. If another installed plugin or theme contains a suitable code gadget, attackers could delete files, access sensitive data, or execute arbitrary code on the website.

## Quick answers

**Is CVE-2026-16062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16062 being exploited in the wild.

**How severe is CVE-2026-16062?** Medium severity, with a CVSS score of 6.6, published 2 August 2026.

**Which products and versions are affected?** mage-eventpress Event Booking Manager for WooCommerce before 5.3.7.

**Is there a fix for CVE-2026-16062?** A patch was published on 2026-01-01: Fix available in version 5.3.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16062 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16062?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP object injection (CWE-502) in the plugin's handling of event timeline "Day content" and FAQ answer fields. The plugin stores user input via unslash operations without preventing deserialization, and later deserializes this data in AJAX handlers (mep_change_date_status and get_mpwem_ticket) without specifying an allowed_classes restriction on unserialize(). Contributors and above can craft serialized PHP objects and plant them in draft events; the objects are later unserialized during AJAX requests, triggering __wakeup() and __destruct() magic methods. While the plugin itself contains no usable gadget chain, chaining with POP gadgets from other plugins or themes enables file operations, data theft, or RCE. The fix was incomplete; version 5.3.7 addresses this issue.

## Affected products

- mage-eventpress Event Booking Manager for WooCommerce before 5.3.7

## Timeline

- 2026-07-22: disclosed
- 2026-08-02: advisory: NVD published
- 2026-01-01: patched: Fix available in version 5.3.7

## References

- [https://wpscan.com/vulnerability/2e2bc528-0f06-4d99-8597-1f8a0fd57b39/](https://wpscan.com/vulnerability/2e2bc528-0f06-4d99-8597-1f8a0fd57b39/)