CVE-2026-16062

This is the third object-injection advisory for the Event Booking Manager for WooCommerce plugin in roughly as many years. That pattern matters: the vendor has repeatedly patched the reported proof-of-concept without removing the underlying unsafe deserialization surface. Treat every version of this plugin as a permanent deserialization hazard regardless of patch level. The critical technical detail most scoring systems miss is the Contributor-level access requirement. This vulnerability does not require administrator credentials — any user with Contributor role (event staff, guest authors, community managers) can trigger the unsafe unserialize() call through plugin-specific input fields. On WordPress multi-site networks, this creates a lateral movement vector: a Contributor on one subsite can escalate to network-level access through the deserialization entry point this plugin provides. The exploitation is conditional — the CVSS 6.6 and EPSS of 0.00351 assume independent probability, but this plugin functions as an amplifier rather than a standalone exploit. It provides the unsafe deserialization entry point; successful RCE requires a POP chain from a second plugin on the same installation. This transforms the risk calculation: the question is not 'will CVE-2026-16062 be exploited?' but 'what is the probability that any plugin on this site contains a usable POP chain?' That probability increases over time. Abandoned plugins with known deserialization gadgets do not get patched — they rot. The Event Booking Manager plugin becomes a resurrection mechanism for every dead-but-installed POP chain in your plugin ecosystem. Sites running multiple plugins, particularly those with irregular update cadences, face a materially different risk profile than the aggregate EPSS suggests. Operational priority: treat this plugin as a compensating-control-requiring component regardless of version. If you cannot remove it, audit your plugin inventory for known object-injection surfaces and monitor for new POP chain disclosures that could pair with this entry point. The plugin's architecture relies on unsafe deserialization — patch-level version numbers are not a reliable security boundary here.

Reviewed through automated stages and approved by a human before publication.