CVE-2026-16062: Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection

id: CVE-2026-16062

info:
  name: Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection
  author: yaswanth77,0x_Akoko
  severity: medium
  description: |
    Event Booking Manager for WooCommerce WordPress plugin <= 5.3.6 contains an insecure deserialization vulnerability caused by deserialization of user-controlled input in event content fields, letting users with Contributor-level access inject PHP objects, potentially leading to arbitrary file deletion, data retrieval, or remote code execution if a POP chain is present.
  impact: |
    Users with Contributor access can inject objects leading to file deletion, data exposure, or remote code execution if a POP chain exists.
  remediation: |
    Upgrade to version 5.3.7 or later.
  reference:
    - https://wpscan.com/vulnerability/2e2bc528-0f06-4d99-8597-1f8a0fd57b39
    - https://plugins.trac.wordpress.org/changeset?old_path=/mage-eventpress/tags/5.3.6&new_path=/mage-eventpress/tags/5.3.7
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16062
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 6.6
    cve-id: CVE-2026-16062
    cwe-id: CWE-502
  metadata:
    verified: true
    max-request: 4
    vendor: magepeopleteam
    product: mage-eventpress
    shodan-query: http.html:"/wp-content/plugins/mage-eventpress/"
    fofa-query: body="/wp-content/plugins/mage-eventpress/"
  tags: cve,cve2026,wp,wordpress,wp-plugin,mage-eventpress,authenticated,intrusive

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        GET /wp-content/plugins/mage-eventpress/readme.txt HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: mepversion
        internal: true
        part: body
        group: 1
        regex:
          - '(?s)==\s*Changelog\s*==.*?=\s*([0-9][0-9.]*)\s*='

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'compare_versions(mepversion, "<= 5.3.6")'
        condition: and

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and

  - raw:
      - |
        GET /wp-admin/post-new.php?post_type=mep_events HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "name=\"mep_enable_recurring\"", "_mpwem_edit_nonce", "mpwem_event_edit_save")'
        condition: and

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=get_mpwem_ticket&post_id=99999999&dates=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"success\":false", "Invalid or unpublished Event.")'
        condition: and
# digest: 4b0a00483046022100fee064144c36340424c4ae72da6d222d346c248eeffb48e97a1433dc0580e697022100f40560b60361651de95b8efb54467891d1f315f563485d6f248b0808db3c129f:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.