CVE-2026-12987

The Events Manager WordPress plugin (versions before 7.3.7 ) is vulnerable to PHP object injection when used in No-User-Account Booking Mode . The flaw exists because the plugin fails to restrict allowed classes when deserializing booker-supplied registration fields stored as booking meta. An una...