CVE-2026-12987

The CVE covers the WordPress plugin Events Manager (before 7.3.7). It describes that in No-User-Account Booking Mode, a booking-field supplied by the booker is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. This object-injection c...