The vulnerability resides in the Event Booking Manager for WooCommerce WordPress plugin, where certain event content fields accept serialized data without proper sanitization. This allows an attacker with Contributor or higher access to inject PHP objects into these fields. The deserialized objects can be used in conjunction with a known PHP Object Initialization chain supplied by another vulnerable plugin or component, potentially enabling arbitrary file deletion, sensitive data disclosure, or remote code execution, depending on the available payload chain.

WordPress sites running the Event Booking Manager for WooCommerce plugin older than version 5.3.7 are affected. Sites that grant Contributor-level permissions to users that can edit event content or FAQ sections are particularly vulnerable. The risk also extends to installations that have other older versions of the same plugin or compatible components that may provide a payload chain.

The EPSS score is less than 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the impact could be severe if an attacker gains Contributor access and a suitable POI chain is present. The attack vector is likely local or authenticated; an attacker must have Contributor or higher privileges to inject the payload. The absence of an immediate pop chain within this plugin reduces risk, but the presence of other vulnerable components could elevate the threat to remote code execution. The CVSS score of 6.6 indicates moderate severity.