Event Ticket Price Manipulation in Event Booking Manager for WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-16067

Affected Vendors & Products

Vendor	Product	Version / Range
wp_event_booking_manager	booking_manager	to 5.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Event Booking Manager for WooCommerce (Pro) WordPress plugin before version 5.0.3. It fails to validate ticket prices on the server during checkout, relying instead on client-supplied prices. This allows unauthenticated users to book paid event tickets for free by manipulating the price input.

Impact Analysis

Unauthenticated attackers could exploit this to book paid event tickets without paying, creating completed bookings and valid tickets at no cost. This could lead to financial losses for event organizers and misuse of ticketing systems.

Mitigation Strategies

Update the Event Booking Manager for WooCommerce (Pro) plugin to version 5.0.3 or later to address the server-side validation issue.

Hi! I’m here to help you understand CVE-2026-16067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70