The Event Booking Manager for WooCommerce plugin contains a flaw where quick‑edit functions only confirm a global capability rather than verifying that a user is allowed to modify the specific event object. As a result, anyone with the Contributor role or higher can change the title and publish status of any post or page on the site, regardless of ownership. This omission enables unauthorized defacement, removal, or alteration of content across the site.

WordPress sites installing the Event Booking Manager for WooCommerce plugin with a version earlier than 5.3.7 are affected. The vulnerability applies to all installations where the Contributor role is present, including default or custom roles possessing edit or publish capabilities.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. Because the flaw requires authenticated access with a Contributor or higher role and relies on internal admin interfaces, the attack surface is limited to users who can log in. The vulnerability is not listed in CISA’s KEV catalog. In the event of exploitation, an attacker could manipulate arbitrary post content, potentially defacing the site or disrupting legitimate content.