What is the CVSS score of CVE-2026-57713?

CVE-2026-57713 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Events Manager are affected by CVE-2026-57713?

WordPress Events Manager plugin (versions through 7.3.6) contains a vulnerability enabling remote site takeover and data compromise, with no vendor patch available.

How to fix or mitigate CVE-2026-57713?

Within 24 hours, audit all WordPress instances to identify Events Manager versions, assess business criticality, and disable the plugin on non-essential systems. Within 7 days, implement Web Application Firewall rules to block exploitation attempts, enforce network segmentation isolating affected systems, and evaluate alternative event management solutions. Within 30 days, establish a process to deploy version 7.3.7 or later once released by the vendor, complete migration to replacement software if the plugin remains unpatched, and verify no exploitation through log analysis.

Events Manager CVE-2026-57713

EUVD-2026-43368 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

Deserialization Events Manager

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:48 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

AnalysisAI

PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.3.6, letting remote attackers deserialize untrusted data and instantiate arbitrary PHP objects. When paired with a suitable POP gadget chain present in the plugin, WordPress core, or another installed plugin, this can escalate to remote code execution, data theft, or site takeover. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, audit all WordPress instances to identify Events Manager versions, assess business criticality, and disable the plugin on non-essential systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.