PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12987 Webber Zone CVE debrief

The Events Manager WordPress plugin before version 7.3.7 is vulnerable to PHP object injection. This is due to the plugin's unsafe handling of booking-registration data when using No-User-Account Booking Mode. Specifically, a booker-supplied registration field is stored as booking meta and later deserialized without proper restrictions on allowed classes. This vulnerability can be exploited to inject malicious PHP objects, which can then be used to build a gadget chain. The gadget chain can reach a database query that is constructed without proper parameterization, allowing an unauthenticated attacker to read arbitrary database data when the booking is loaded later. This could potentially expose sensitive information such as user password hashes and secret keys.

Vendor
Webber Zone
Product
Events Manager
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Website administrators using the Events Manager WordPress plugin, especially those using No-User-Account Booking Mode, should be aware of this vulnerability and take immediate action to protect their sites.

Technical summary

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterization, allowing an unauthenticated attacker to read arbitrary database data when the booking is later loaded.

Defensive priority

High

Recommended defensive actions

  • Update the Events Manager WordPress plugin to version 7.3.7 or later.
  • Review and restrict access to booking-registration data.
  • Monitor for suspicious database queries and unusual data access patterns.
  • Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
  • Perform a thorough review of existing bookings for potential malicious activity.
  • Implement a Web Application Firewall (WAF) to detect and prevent exploitation attempts.
  • Regularly review and update the Events Manager plugin to ensure the latest security patches are applied.

Evidence notes

The CVE record was published on 2026-07-22T07:16:35.203Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited details are available about the vulnerability, and further investigation is required to fully understand the impact and potential mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12987 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12987

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12987 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12987

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.