CVE-2026-12987: high-severity vulnerability in Events Manager
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.5%
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · Events Managerpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/dac83702-298d-4422-b795-b7684cc3fb2b/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Events Manager
In the same product, most dangerous first.
CVE-2020-35012—Events Manager < 5.9.8 - Admin+ SQL InjectionEPSS 1.5%CVE-2020-35037—Events Manager < 5.9.8 - Cross-Site Scripting (XSS)EPSS 0.9%CVE-2026-18366CRITICALEvents Manager < 7.4.1 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-18050HIGHEvents Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploadsEPSS 0.4%CVE-2026-18057HIGHEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL InjectionEPSS 0.4%CVE-2026-93662MEDIUMEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' ParameterEPSS 0.2%