PHP Object Injection Vulnerability in Events Manager WordPress Plugin
CVE-2026-12987
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 July 2026
Badges
What is CVE-2026-12987?
The Events Manager plugin for WordPress versions prior to 7.3.7 is vulnerable due to improper handling of booking-registration data in No-User-Account Booking Mode. Specifically, a registration field supplied by the booker is stored as booking metadata and later deserialized without restrictions on allowed classes. This flaw allows an unauthenticated attacker to exploit PHP object injection, leading to a potential database query that is improperly parameterized. Thus, sensitive information such as user password hashes and secret keys can be accessed when the booking is retrieved.
Affected Version(s)
Events Manager 0 < 7.3.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.