CVE-2026-16064

This vulnerability allows any Contributor-level user to modify arbitrary posts, pages, and custom post types across the entire WordPress site — not just their own drafts. The root cause is a global capability check (`current_user_can('edit_posts')`) where an object-level check with the post ID should have been used (`current_user_can('edit_post', $post_id)`). The fix requires adding the post ID parameter to the capability verification in any quick-edit or bulk-edit handlers within the plugin. What makes this worth your attention isn't just the technical flaw — it's the blast radius. A Contributor is supposed to be a content submitter, not an editor. They can demote published pages to drafts, rewrite another author's headlines, or modify content in pre-publication states they were never meant to access. This collapses the documented editorial workflow at the role level. The CVSS 5.4 rating may lead to deprioritization, but the actual impact is broader than typical code execution bugs because it undermines WordPress's entire role-based access control model. Check your user role configuration: if Contributors have any access to quick-edit or bulk-action interfaces in Event Booking Manager or related plugins, treat this as urgent. Beyond patching, review your site's other plugins for the same authorization pattern. The `current_user_can('edit_posts')` without an ID parameter is one of the most repeated authorization flaws in the WordPress CVE archive — it appears in dozens of plugins year after year. The pattern is so consistent that it functions as a structural condition rather than individual developer error. Audit your third-party plugins for this pattern, not just this specific CVE.

Reviewed through automated stages and approved by a human before publication.