CVE-2026-16062 is a CWE-502 deserialization of untrusted data vulnerability in the Event Booking Manager for WooCommerce WordPress plugin versions prior to 5.3.7. The vulnerability arises because the plugin does not properly prevent deserialization of user-controlled input in certain event content fields. Users with Contributor-level permissions or higher can inject PHP objects. Although the plugin itself lacks a proof-of-concept gadget chain, the presence of such a chain in another instance or related plugin could lead to severe impacts including arbitrary file deletion, sensitive data disclosure, or remote code execution. This vulnerability is noted as an incomplete fix of earlier object injection issues in the same plugin.

Exploitation requires at least Contributor-level access to the WordPress site. If combined with a gadget chain from another vulnerable plugin or component, an attacker could perform critical actions such as deleting files, retrieving sensitive information, or executing arbitrary code remotely. Without such a gadget chain, the vulnerability alone does not directly lead to these impacts. No known exploits are reported in the wild at this time.

No official patch or remediation level has been confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for updates from the plugin vendor. Avoid running multiple vulnerable instances of the plugin that could provide gadget chains enabling exploitation.