[sudo-sys] Re: wordpress vulnerability emailed to us

---------- Forwarded message ---------- Date: Fri, 24 Jul 2026 05:11:31 +0000 From: Evan Harris via Info <info(a)sudoroom.org> Reply-To: Evan Harris <security(a)mail.mcpsec.dev> To: info(a)sudoroom.org Subject: [sudo-info] Security notice: Events Manager plugin update recommended on sudoroom.org Hi there, I'm reaching out about a possible security issue affecting your website. Your site runs the WordPress plugin Events Manager, version 7.2.3.1 (read from the plugin's public readme.txt). That release is within the affected range of the issue below (fixed in 7.3.7). Whether your site is actually exposed depends on a setting we cannot see: this flaw is only exploitable when Events Manager accepts bookings without requiring a user account ("No-User-Account Booking Mode"). If you accept public bookings that way, please update to 7.3.7 or later. The specific issue affecting that version range: - CVE-2026-12987: an unauthenticated PHP object injection leading to SQL injection: on sites using No-User-Account Booking Mode, a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, and the resulting object-injection chain reaches an unparameterised database query — so an unauthenticated attacker can read arbitrary database data such as password hashes and secret keys (affected: Events Manager 4.0.0 through 7.3.6, fixed in 7.3.7 — only exploitable on sites using No-User-Account Booking Mode). The fix is to update Events Manager to version 7.3.7 or later; the write-up below walks through how to check your version and upgrade safely. One important qualifier, so this isn't over-stated: whether your site is actually exposed depends on a setting we cannot see. This issue is only exploitable when Events Manager is configured for "No-User-Account Booking Mode" — i.e. it accepts bookings from visitors who are not logged in. We can read your plugin version but not your booking configuration, so this is a precautionary heads-up, not a confirmed finding for your site, and we have no indication it is being exploited. If you do accept public bookings without requiring an account, please treat updating to 7.3.7 or later as a priority; because the underlying flaw could expose database contents such as password hashes and secret keys, rotating those secrets after updating would be a sensible precaution in that case. We did not access your site, your database, or the booking flow, and we did not test or exploit anything. You can verify all of this independently, from sources that aren't me: - The plugin on the WordPress.org directory, and its current version: https://wordpress.org/plugins/events-manager/ - CVE-2026-12987 at the US National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-12987 - My own write-up, with how to check your version and upgrade safely: https://mcpsec.dev/events-security/ To be clear about what I did: I only looked at files your site already serves to every visitor (the Events Manager plugin's public readme.txt, and your homepage), the same way your homepage is public. I did not access your WordPress admin area, your database, or any private part of the site. In particular, I did not touch the vulnerable booking path, and I did not test or exploit anything. This is a version-based observation, and — because this issue is config-dependent — a site in the affected range may not be exposed at all. If you're not the person who maintains the site, please forward this to whoever does. I'm happy to help if you have any questions. Best, Evan Security Researcher at mcpsec.dev This is a good-faith security notification intended for the operator of the website referenced above. If you are not the right person, or received this in error, please reply to let us know and we will update our records, or simply disregard this message. NOTE: emails to the Info list were sent to an individual email address (such as info(a)sudoroom.org) with the PRESUMPTION OF PRIVACY. They may include personal information which the sender would not have sent to a public list (such as sudo-discuss). If you must forward messages to a public list, please take great care to REMOVE SENSITIVE INFORMATION! _______________________________________________ Info mailing list -- info(a)sudoroom.org To unsubscribe send an email to info-leave(a)sudoroom.org

_______________________________________________ sudo-sys mailing list -- sudo-sys(a)sudoroom.org To unsubscribe send an email to sudo-sys-leave(a)sudoroom.org More options at https://sudoroom.org/lists/postorius/lists/sudo-sys.sudoroom.org/