What is the CVSS score of CVE-2026-57713?

CVE-2026-57713 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Events Manager are affected by CVE-2026-57713?

WordPress Events Manager plugin (versions through 7.3.6) contains a vulnerability enabling remote site takeover and data compromise, with no vendor patch available.

How to fix or mitigate CVE-2026-57713?

Within 24 hours, audit all WordPress instances to identify Events Manager versions, assess business criticality, and disable the plugin on non-essential systems. Within 7 days, implement Web Application Firewall rules to block exploitation attempts, enforce network segmentation isolating affected systems, and evaluate alternative event management solutions. Within 30 days, establish a process to deploy version 7.3.7 or later once released by the vendor, complete migration to replacement software if the plugin remains unpatched, and verify no exploitation through log analysis.

Events Manager CVE-2026-57713

EUVD-2026-43368 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

WordPress Deserialization Events Manager Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:48 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

AnalysisAI

PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.3.6, letting remote attackers deserialize untrusted data and instantiate arbitrary PHP objects. When paired with a suitable POP gadget chain present in the plugin, WordPress core, or another installed plugin, this can escalate to remote code execution, data theft, or site takeover. Reported by Patchstack with a CVSS of 8.8; there is no public exploit identified at time of analysis and it is not on CISA KEV, though the network vector combined with only requiring user interaction makes it a serious patch priority.