CVE-2026-12987

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.3.7

Description On sites using No-User-Account Booking Mode, the software fails to safely handle booking-registration data. A registration field supplied by a booker is stored as booking meta and subsequently deserialized without restricting allowed classes, which enables PHP object injection. This process creates a gadget chain that leads to a database query constructed without parameterization, allowing an unauthenticated attacker to read arbitrary database data, such as secret keys and user password hashes, when the booking is loaded.

Recommendations Update Events Manager to version 7.3.7 or later.