7.5
Élevée
CVE-2026-12987 The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using…
Description
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Events Manager 7.3 | premières → < 7.3.7 | 7.3.7 |
Autres CVE de Events Manager
Les 8 CVE de Events Manager →
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search…
4.3
Moyenne
CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers…
2.7
Faible
CVE-2026-18366
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the…
9.8
Critique
CVE-2026-18057
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it…
8.1
Élevée