Executive brief
The Events Manager plugin for WordPress, used for managing event registrations and bookings, contains a security flaw in how it handles booking data. An unauthenticated attacker can submit specially crafted registration information that, when later viewed by a site administrator or the user, allows the attacker to run unauthorized database commands. This could lead to the theft of sensitive information, including user password hashes and secret site keys.
Technical details
The Events Manager plugin fails to safely handle booking-registration data when 'No-User-Account Booking Mode' is active. User-supplied registration fields are stored as booking metadata and subsequently processed using PHP's unserialize() function without proper class restrictions. This enables a PHP Object Injection attack. By utilizing a gadget chain involving the EM_Booking class, an attacker can trigger an unauthenticated SQL injection during the booking loading process (e.g., when an admin views the bookings list). The SQL query is constructed without parameterization, allowing the attacker to extract sensitive data from the WordPress database. This vulnerability is fixed in version 7.3.7.
Affected products
- Unknown Events Manager < 7.3.7
Timeline
- 2026-07-01: disclosed: Initial public disclosure by WPScan
- 2026-07-22: advisory: NVD publication date
- 2026-07-22: patched: Fixed in version 7.3.7