CVE-2026-16067CWE-472

CVE-2026-16067

Medium · published August 7, 2026

CVSS v3.1

5.3

EPSS

Percentile

24.2

In the wild

Unconfirmed

What it is

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00324 · 24.2th percentile
Weakness: CWE-472 · External Control of Assumed-Immutable Web Parameter
Published: 2026-08-07T02:16Z

References (1)

https://wpscan.com/vulnerability/f07eb346-7f25-4c5b-acda-aeec57d74496/ · [email protected]

EPSS history

Timeline

06 AUG 17:14Z
Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price
cvelistv5