What is CVE-2026-12987?
The Events Manager plugin before 7.3.7 insecurely handles booking-registration data under No-User-Account Booking Mode. Supplied fields are stored as booking meta and deserialized without class restriction, enabling PHP object injection. Updating to version 7.3.7 or later mitigates this risk.
Azərbaycanca: The Events Manager plaqini (7.3.7 öncəsi versiyalar) No-User-Account Booking Mode istifadə edən saytlarda booking-registrasiya məlumatlarını təhlükəsiz işləmir. Təcavüzkar booking metaya xüsusi PHP obyekti yeridə (PHP object injection) və uzaqdan kod icrası potensialı yarada bilər. Plaqini son versiyaya (7.3.7+) yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-502
FAQ2
In which mode of the Events Manager plugin is CVE-2026-12987 exploitable?
The vulnerability exists only on sites where No-User-Account Booking Mode is enabled.
What risk does CVE-2026-12987 pose?
An attacker can inject a malicious PHP object into booking meta, leading to PHP object injection and potential remote code execution (RCE).
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.