CVE-2026-12987: Events Manager WordPress SQLi Vulnerability

CVE-2026-12987 Overview

CVE-2026-12987 affects the Events Manager WordPress plugin before version 7.3.7. The plugin fails to safely handle booking-registration data on sites configured with No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query built without parameterisation, producing a SQL injection primitive [CWE-89]. An unauthenticated attacker can read arbitrary database data, including WordPress user password hashes and secret keys, when the booking is later loaded.

Critical Impact
Unauthenticated attackers can extract sensitive database contents such as password hashes and WordPress secret keys by submitting a crafted booking registration.

Affected Products

Events Manager WordPress plugin versions before 7.3.7
WordPress sites using No-User-Account Booking Mode
Any site exposing the booking registration workflow to unauthenticated users

Discovery Timeline

2026-07-22 - CVE-2026-12987 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-12987

Vulnerability Analysis

The vulnerability chains two distinct weaknesses into a single unauthenticated data-disclosure primitive. The booking workflow accepts user-supplied registration input on sites that permit bookings without account creation. That input is persisted as serialized booking meta.

When the booking is subsequently loaded, the plugin calls PHP unserialize() on the stored data without providing an allowed_classes restriction. This permits instantiation of arbitrary classes present in the WordPress runtime, triggering magic methods such as __wakeup() or __destruct() on attacker-controlled object graphs. The resulting gadget chain drives execution into a database routine.

The reachable database call concatenates untrusted values directly into an SQL statement rather than using prepared statements or $wpdb->prepare(). The gadget chain therefore promotes object injection into SQL injection, allowing arbitrary SELECT operations across the WordPress database.

Root Cause

The root cause is twofold: unrestricted deserialization of attacker-controlled booking meta, and construction of an SQL query without parameterisation on a code path reachable from a deserialization gadget. Either defect alone would be serious. Combined, they yield an unauthenticated pre-auth read primitive.

Attack Vector

The attack is remote and requires no authentication or user interaction. An attacker submits a booking registration containing a serialized payload in the vulnerable field. When the plugin later loads the booking record, deserialization triggers the gadget chain, executes the unparameterised query, and returns or exposes rows such as those from wp_users and wp_options. Exposed data typically includes hashed user credentials and the WordPress secret keys used to sign authentication cookies.

No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12987

Indicators of Compromise

Booking records containing serialized PHP payloads with recognizable markers such as O: (object) or a: (array) followed by class names in registration fields
Unexpected outbound content or error responses from booking pages that reveal database column values
New or modified administrative WordPress users, or password resets shortly after booking submissions from unknown IPs
Access log entries showing POST requests to booking endpoints with unusually large or base64-like registration payloads

Detection Strategies

Inspect the Events Manager booking meta tables for serialized strings that reference PHP class names not used by the plugin under normal operation
Enable and review PHP error logs for unserialize() warnings or unexpected __wakeup/__destruct invocations tied to booking page requests
Deploy web application firewall rules that flag serialized PHP object patterns (O:\d+:") in POST parameters targeting Events Manager endpoints

Monitoring Recommendations

Alert on any change to wp_users password hashes or wp_options secret key entries following inbound requests to booking URLs
Track query patterns from the WordPress database user for SELECT statements that reference user_pass, user_email, or option_value originating from plugin code paths
Monitor plugin version inventories to identify WordPress installations still running Events Manager below 7.3.7

How to Mitigate CVE-2026-12987

Immediate Actions Required

Update Events Manager to version 7.3.7 or later on every affected WordPress site
Rotate all WordPress secret keys defined in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and their salts)
Force password resets for administrative and privileged accounts if compromise cannot be excluded
Audit booking meta records for serialized payloads and purge suspicious entries

Patch Information

The vendor addressed the issue in Events Manager 7.3.7 by restricting deserialization of booking meta and parameterising the affected database query. Refer to the WPScan Vulnerability Report for advisory details and fixed-version confirmation.

Workarounds

Disable No-User-Account Booking Mode until the plugin is upgraded, requiring authenticated users to complete bookings
Temporarily deactivate the Events Manager plugin on sites that cannot be updated immediately
Apply a web application firewall rule that rejects requests to booking endpoints containing serialized PHP object markers such as O: followed by a class name

bash

# Example WAF rule (ModSecurity) blocking serialized PHP objects on booking endpoints
SecRule REQUEST_URI "@contains /events/" \
  "chain,id:1029871,phase:2,deny,status:403,msg:'Blocked serialized PHP object in Events Manager booking'"
SecRule ARGS "@rx O:\d+:\"[A-Za-z_\\\\]+\"" "t:none"