sudo-sys July 2026

sudo-sys@sudoroom.org

4 participants
5 discussions

by Jake

---------- Forwarded message ---------- Date: Fri, 24 Jul 2026 05:11:31 +0000 From: Evan Harris via Info <info(a)sudoroom.org> Reply-To: Evan Harris <security(a)mail.mcpsec.dev> To: info(a)sudoroom.org Subject: [sudo-info] Security notice: Events Manager plugin update recommended on sudoroom.org Hi there, I'm reaching out about a possible security issue affecting your website. Your site runs the WordPress plugin Events Manager, version 7.2.3.1 (read from the plugin's public readme.txt). That release is within the affected range of the issue below (fixed in 7.3.7). Whether your site is actually exposed depends on a setting we cannot see: this flaw is only exploitable when Events Manager accepts bookings without requiring a user account ("No-User-Account Booking Mode"). If you accept public bookings that way, please update to 7.3.7 or later. The specific issue affecting that version range: - CVE-2026-12987: an unauthenticated PHP object injection leading to SQL injection: on sites using No-User-Account Booking Mode, a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, and the resulting object-injection chain reaches an unparameterised database query — so an unauthenticated attacker can read arbitrary database data such as password hashes and secret keys (affected: Events Manager 4.0.0 through 7.3.6, fixed in 7.3.7 — only exploitable on sites using No-User-Account Booking Mode). The fix is to update Events Manager to version 7.3.7 or later; the write-up below walks through how to check your version and upgrade safely. One important qualifier, so this isn't over-stated: whether your site is actually exposed depends on a setting we cannot see. This issue is only exploitable when Events Manager is configured for "No-User-Account Booking Mode" — i.e. it accepts bookings from visitors who are not logged in. We can read your plugin version but not your booking configuration, so this is a precautionary heads-up, not a confirmed finding for your site, and we have no indication it is being exploited. If you do accept public bookings without requiring an account, please treat updating to 7.3.7 or later as a priority; because the underlying flaw could expose database contents such as password hashes and secret keys, rotating those secrets after updating would be a sensible precaution in that case. We did not access your site, your database, or the booking flow, and we did not test or exploit anything. You can verify all of this independently, from sources that aren't me: - The plugin on the WordPress.org directory, and its current version: https://wordpress.org/plugins/events-manager/ - CVE-2026-12987 at the US National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-12987 - My own write-up, with how to check your version and upgrade safely: https://mcpsec.dev/events-security/ To be clear about what I did: I only looked at files your site already serves to every visitor (the Events Manager plugin's public readme.txt, and your homepage), the same way your homepage is public. I did not access your WordPress admin area, your database, or any private part of the site. In particular, I did not touch the vulnerable booking path, and I did not test or exploit anything. This is a version-based observation, and — because this issue is config-dependent — a site in the affected range may not be exposed at all. If you're not the person who maintains the site, please forward this to whoever does. I'm happy to help if you have any questions. Best, Evan Security Researcher at mcpsec.dev This is a good-faith security notification intended for the operator of the website referenced above. If you are not the right person, or received this in error, please reply to let us know and we will update our records, or simply disregard this message. NOTE: emails to the Info list were sent to an individual email address (such as info(a)sudoroom.org) with the PRESUMPTION OF PRIVACY. They may include personal information which the sender would not have sent to a public list (such as sudo-discuss). If you must forward messages to a public list, please take great care to REMOVE SENSITIVE INFORMATION! _______________________________________________ Info mailing list -- info(a)sudoroom.org To unsubscribe send an email to info-leave(a)sudoroom.org

13 hours, 53 minutes

Cron <root@sudoroom> cd / && run-parts --report /etc/cron.hourly

by root＠sudoroom.org

run-parts: /etc/cron.hourly/droplet-agent exited with return code 100

4 days, 19 hours

https://sudoroom.org - SSL Certificate Valid!

by StatusCake Team

This is an HTML mail. Please use a mail-client that supports this message

3 weeks, 1 day

https://sudoroom.org - SSL Certificate Expiring Soon!

by StatusCake Team

This is an HTML mail. Please use a mail-client that supports this message

3 weeks, 2 days

Cron <www-data@sudoroom> [ -f /usr/bin/django-admin ] && flock -n /var/run/mailman3-web/cron.monthly /usr/share/mailman3-web/manage.py runjobs monthly

by root＠sudoroom.org

ERROR OCCURED IN JOB: update_and_clean_index (APP: hyperkitty) Traceback (most recent call last): File "/usr/lib/python3/dist-packages/django_extensions/management/commands/runjobs.py", line 40, in runjobs job().execute() File "/usr/lib/python3/dist-packages/hyperkitty/jobs/update_and_clean_index.py", line 37, in execute run_with_lock(update_index, remove=True) File "/usr/lib/python3/dist-packages/hyperkitty/lib/utils.py", line 181, in run_with_lock log.exception("Failed to update the fulltext index: %s", e) File "/usr/lib/python3/dist-packages/flufl/lock/_lockfile.py", line 447, in __exit__ self.unlock() File "/usr/lib/python3/dist-packages/flufl/lock/_lockfile.py", line 398, in unlock raise NotLockedError('Already unlocked') flufl.lock._lockfile.NotLockedError: Already unlocked

3 weeks, 4 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

sudo-sys July 2026