CVE-2026-12987
Deferred Deferred - Pending Action

Events Manager Plugin PHP Object Injection Vulnerability

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: WPScan

Description
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-10
NVD
CVE-2026-12987
EUVD
EUVD-2026-47613

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
events_manager events_manager to 7.3.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated SQL injection in the Events Manager WordPress plugin versions below 7.3.7. It occurs due to improper handling of booking-registration data when No-User-Account Booking Mode is enabled. Attackers exploit PHP object injection by injecting malicious serialized data into booking forms, which later triggers a non-parameterized database query when the booking is accessed.

Detection Guidance

Check if the Events Manager plugin version is below 7.3.7. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Look for suspicious booking registrations with unusual payloads in the database.

Impact Analysis

Unauthenticated attackers can read sensitive database data such as user password hashes or secret keys. The attack involves three steps: harvesting a public nonce, injecting a malicious payload into the booking form, and triggering the SQL injection when the booking is accessed by an administrator or the booker.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, potentially violating GDPR and HIPAA compliance requirements. Exposure of user password hashes or secret keys may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Update the Events Manager plugin to version 7.3.7 or later immediately. Disable No-User-Account Booking Mode if not required. Review recent bookings for malicious payloads and remove any suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart