{"api_version":"1","generated_at":"2026-08-02T20:39:00+00:00","cve":"CVE-2026-16064","urls":{"html":"https://cve.report/CVE-2026-16064","api":"https://cve.report/api/cve/CVE-2026-16064.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-16064","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-16064"},"summary":{"title":"Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event","description":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-08-02 06:16:38","updated_at":"2026-08-02 06:16:38"},"problem_types":["CWE-863 Incorrect Authorization"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/881ba365-b2ce-41e1-92bb-e5fa275f8a06/","name":"https://wpscan.com/vulnerability/881ba365-b2ce-41e1-92bb-e5fa275f8a06/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16064","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16064","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Event Booking Manager for WooCommerce","version":"affected 5.3.7 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Yaswanth Reddy Sunkara","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Event Booking Manager for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"5.3.7","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Yaswanth Reddy Sunkara"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own."}],"problemTypes":[{"descriptions":[{"description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-02T06:00:12.946Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/881ba365-b2ce-41e1-92bb-e5fa275f8a06/"}],"source":{"discovery":"EXTERNAL"},"title":"Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-16064","datePublished":"2026-08-02T06:00:12.946Z","dateReserved":"2026-07-17T12:58:58.934Z","dateUpdated":"2026-08-02T06:00:12.946Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-02 06:16:38","lastModifiedDate":"2026-08-02 06:16:38","problem_types":["CWE-863 Incorrect Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"16064","Ordinal":"1","Title":"Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arb","CVE":"CVE-2026-16064","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"16064","Ordinal":"1","NoteData":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.","Type":"Description","Title":"Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arb"}]}}}