Events Manager CVE-2026-12987

The site must be running Events Manager before 7.3.7 with No-User-Account Booking Mode (guest/no-account bookings) enabled - this specific booking configuration is the concrete prerequisite named in the advisory, since it is what allows an unauthenticated booker to supply the malicious registration field that is stored and later deserialized. No authentication is required (CVSS PR:N confirms unauthenticated) and no user interaction from a victim is needed to inject the payload, though the malicious object is triggered when the booking is subsequently loaded. The main limiting factor is that sites using account-required booking mode (the non-guest configuration) are not exposed through this path, so exploitation is broad only across the subset of installations that permit guest bookings.

Signals are moderately consistent toward a real but conditional threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact but no integrity or availability effect, which fits a read-only SQLi. SSVC reinforces this: exploitation=PoC, automatable=yes, technical impact=partial (partial, not total, because only confidentiality is affected). Publicly available exploit code raises practical risk, but the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. The key tempering factor absent from the raw CVSS score is that exploitation requires the site to run No-User-Account (guest) Booking Mode - a non-default deployment choice - so the AC:L rating slightly understates the real-world precondition. Net: prioritise patching on any guest-booking-enabled site, but sites not using that mode are not exposed by this specific chain.

On a WordPress site using Events Manager guest booking, an unauthenticated attacker submits an event booking and places a crafted serialized PHP object into a registration field, which is stored as booking meta. When an admin or the application later loads that booking, the unsafe deserialization instantiates the object and triggers a gadget chain into an unparameterised SQL query, returning database contents such as user password hashes to the attacker. Publicly available exploit code (WPScan) and automatable exploitation lower the skill barrier considerably.