{"id":"CVE-2026-12987","aliases":["EUVD-2026-47613","GHSA-wpwx-q57v-jhwg"],"status":"published","title":"Events Manager \u003c 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration","description":"The Events Manager  WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00452,"percentile":0.3973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-07-22T06:00:02Z","modified":"2026-07-22T16:30:26Z","products":[{"vendor":"pixelite","product":"events manager"},{"vendor":"unknown","product":"events manager"}],"references":[{"url":"https://wpscan.com/vulnerability/dac83702-298d-4422-b795-b7684cc3fb2b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12987"},{"url":"https://wpscan.com/vulnerability/dac83702-298d-4422-b795-b7684cc3fb2b"},{"url":"https://github.com/advisories/GHSA-wpwx-q57v-jhwg"}],"sources":{"cve":[{"id":"CVE-2026-12987","title":"Events Manager \u003c 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration","description":"The Events Manager  WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.","status":"published","published":"2026-07-22T06:00:02.698Z","modified":"2026-07-22T12:59:16.253Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-47613","description":"The Events Manager  WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.","status":"published","published":"2026-07-22T06:00:02Z","modified":"2026-07-22T12:59:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:46.900828Z"}],"ghsa":[{"id":"GHSA-wpwx-q57v-jhwg","title":"The Events Manager  WordPress plugin before 7.3.7 does not safely handle booking-registration...","description":"The Events Manager  WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.","status":"published","published":"2026-07-22T09:32:13Z","modified":"2026-07-22T15:32:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:09:39.270941Z"}],"nvd":[{"id":"CVE-2026-12987","description":"The Events Manager  WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.","status":"published","published":"2026-07-22T07:16:35.203Z","modified":"2026-07-22T16:30:26.533Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:32.089897Z"}]}}