WordPress Events Manager PHP Object Injection via Unsafe Deserialization

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-12987 is a critical PHP object injection vulnerability in the WordPress Events Manager plugin affecting versions before 7.3.7. The vulnerability exists in the No-User-Account Booking Mode, where user-supplied registration field data is stored as booking metadata and later unsafely deserialized without restricting which PHP classes can be instantiated. This allows attackers to inject malicious serialized objects that trigger gadget chains—sequences of existing code that can be chained together through magic methods. The resulting chain reaches an unparameterized database query, enabling unauthenticated attackers to extract sensitive data including user password hashes, API keys, and secret keys. Any WordPress site running an affected version of this plugin with No-User-Account Booking Mode enabled is vulnerable, regardless of authentication status, making this a high-impact threat to WordPress installations managing event bookings.

Casky's skill mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) combined with Claude's extended reasoning enables detection of the attack chain patterns underlying this vulnerability. Practitioners using Casky would identify 322 relevant skills spanning object injection detection, unsafe deserialization patterns, SQL injection variations, and gadget chain exploitation. The platform's analysis would flag: (1) detection of suspicious serialized PHP objects in booking metadata inputs, (2) unsafe unserialize() function calls without class whitelisting, (3) database queries constructed via string concatenation rather than prepared statements, and (4) the connection between user-controlled input in booking fields and backend deserialization processes. Security teams would see findings highlighting the attack progression from initial booking registration (TA0001) through exploitation of the gadget chain to unauthorized data access, enabling them to prioritize patching and implement input validation controls.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12987.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-12987

Casky has 322 skills that investigate the attack patterns behind CVE-2026-12987. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn