CVE-2026-16067

Deferred Deferred - Pending Action

Event Ticket Price Manipulation in Event Booking Manager for WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-16067

Affected Vendors & Products

Vendor	Product	Version / Range
wp_event_booking_manager	booking_manager	to 5.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-472	The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Event Booking Manager for WooCommerce (Pro) WordPress plugin before version 5.0.3. It fails to validate ticket prices on the server during checkout, relying instead on client-supplied prices. This allows unauthenticated users to book paid event tickets for free by manipulating the price input.

Detection Guidance

This vulnerability can be detected by checking the installed version of the Event Booking Manager for WooCommerce (Pro) plugin. If the version is below 5.0.3, the system is vulnerable. Review server logs for unauthenticated ticket bookings with zero or incorrect payment amounts.

Impact Analysis

Unauthenticated attackers could exploit this to book paid event tickets without paying, creating completed bookings and valid tickets at no cost. This could lead to financial losses for event organizers and misuse of ticketing systems.

Compliance Impact

This vulnerability allows unauthenticated users to book paid event tickets for free, which could lead to unauthorized access to events and potential data exposure. This may violate compliance requirements under GDPR (data protection) and HIPAA (privacy and security) if event attendee data is compromised or improperly handled due to the lack of proper access controls.

Mitigation Strategies

Update the Event Booking Manager for WooCommerce (Pro) plugin to version 5.0.3 or later to address the server-side validation issue.

Hi! I’m here to help you understand CVE-2026-16067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70