CVE-2026-57713

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.3.7

Description The Events Manager plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present within the software itself, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update the plugin to a version later than 7.3.6.