The Events Manager WordPress plugin before 7.3.7 allows an unauthenticated attacker to submit crafted booking-registration data when the site is configured for No-User-Account Booking Mode. The plugin stores this data as booking meta and later deserializes it without restricting allowed classes, enabling PHP object injection. The injected objects form a gadget chain that reaches an SQL query built without parameterization, which satisfies the criteria of CWE-89 SQL Injection. A successful exploitation therefore lets the attacker read arbitrary database rows, including user password hashes and secret keys.

WordPress sites that have the Events Manager plugin installed with a version older than 7.3.7 and have enabled No-User-Account Booking Mode. The vulnerability is specifically triggered by the booking-registration fields used by bookers with no logged‑in accounts.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of less than 1% suggests that exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because no authentication is required and the attack vector involves only a standard HTTP request to submit a booking, the likelihood of an attacker executing this vector on vulnerable sites is non‑zero. If successful, the attacker gains read‑only access to sensitive data in the database without altering it, which could compromise credential confidentiality and enable downstream breaches.