PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12987 Webber Zone CVE debrief

The Events Manager WordPress plugin before version 7.3.7 is vulnerable to PHP object injection. This is due to the plugin's unsafe handling of booking-registration data when using No-User-Account Booking Mode. Specifically, a booker-supplied registration field is stored as booking meta and later deserialized without proper restrictions on allowed classes. This vulnerability can be exploited to inject malicious PHP objects, which can then be used to build a gadget chain. The gadget chain can reach a database query that is constructed without proper parameterization, allowing an unauthenticated attacker to read arbitrary database data when the booking is loaded later. This could potentially expose sensitive information such as user password hashes and secret keys.

Vendor
Webber Zone
Product
Events Manager
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Website administrators using the Events Manager WordPress plugin, especially those using No-User-Account Booking Mode, should be aware of this vulnerability and take immediate action to protect their sites.

Technical summary

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterization, allowing an unauthenticated attacker to read arbitrary database data when the booking is later loaded.

Defensive priority

High

Recommended defensive actions

  • Update the Events Manager WordPress plugin to version 7.3.7 or later.
  • Review and restrict access to booking-registration data.
  • Monitor for suspicious database queries and unusual data access patterns.
  • Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
  • Perform a thorough review of existing bookings for potential malicious activity.
  • Implement a Web Application Firewall (WAF) to detect and prevent exploitation attempts.
  • Regularly review and update the Events Manager plugin to ensure the latest security patches are applied.

Evidence notes

The CVE record was published on 2026-07-22T07:16:35.203Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited details are available about the vulnerability, and further investigation is required to fully understand the impact and potential mitigations.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T07:16:35.203Z and has not been modified since then. The NVD entry is currently in the 'Received' status.