The Event Booking Manager for WooCommerce WordPress plugin before version 5.3.7 does not adequately prevent deserialization of user-supplied input in some event content fields. This vulnerability allows users with Contributor-level or greater privileges to inject PHP objects. Although the plugin lacks a native POP (Property Oriented Programming) chain, exploitation is possible if another vulnerable plugin or instance with a POP chain is installed. Potential impacts include arbitrary file deletion, sensitive data retrieval, or remote code execution. This vulnerability is a continuation of incomplete remediation of earlier object injection issues in the same plugin.

Users with Contributor-level access or higher can exploit this vulnerability to inject PHP objects via deserialization. If a suitable POP chain is available through this or another installed vulnerable plugin, attackers could perform critical actions such as deleting files, accessing sensitive information, or executing arbitrary code remotely. This elevates the risk of significant compromise on affected WordPress sites using the vulnerable plugin versions.

Upgrade the Event Booking Manager for WooCommerce WordPress plugin to version 5.3.7 or later, where this vulnerability has been addressed. Since this is an incomplete fix of prior object injection issues, ensure all instances of the plugin are updated to prevent exploitation. No other specific mitigations are indicated.