CVE-2026-12987
High
Description
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.
SeverityHigh
CVSS7.5
Exploit probability39. percentile0.5%
ProductEvents Manager
PublishedJul 22, 2026
First seenJul 22, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- Events Manager7.3.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Events Manager | v < 7.3.7 | 7.3.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.