EUVD-2026-47613
GHSA-wpwx-q57v-jhwg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated read-only SQLi via object injection gives AV:N/PR:N and C:H, with I:N/A:N as the sink only discloses data; AC:L kept despite the guest-mode precondition.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.
AnalysisAI
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The site must be running Events Manager before 7.3.7 with No-User-Account Booking Mode (guest/no-account bookings) enabled - this specific booking configuration is the concrete prerequisite named in the advisory, since it is what allows an unauthenticated booker to supply the malicious registration field that is stored and later deserialized. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderately consistent toward a real but conditional threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a WordPress site using Events Manager guest booking, an unauthenticated attacker submits an event booking and places a crafted serialized PHP object into a registration field, which is stored as booking meta. When an admin or the application later loads that booking, the unsafe deserialization instantiates the object and triggers a gadget chain into an unparameterised SQL query, returning database contents such as user password hashes to the attacker. … |
| Remediation | Vendor-released patch: 7.3.7 - upgrade the Events Manager plugin to 7.3.7 or later, which is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress instances running Events Manager, confirm which have No-User-Account Booking Mode enabled, and audit database access logs for suspicious queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today