CVE-2026-57713

WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

Published Jul 13, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

Analysis

Technical impact

The Events Manager plugin for WordPress deserializes input from untrusted sources, enabling PHP Object Injection in versions up to 7.3.6. According to CWE-502, this flaw can let an attacker execute arbitrary PHP code on the host, compromising the confidentiality, integrity, and availability of the affected site.

Affected Systems

All WordPress sites running the Events Manager plugin version 7.3.6 or earlier are affected. The vendor, Marcus (also known as @msykes), released the affected product, the Events Manager plugin, for all releases through 7.3.6.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector is a remote web request containing crafted serialized data that reaches the plugin's vulnerable deserialization routine.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Marcus (aka @msykes)

Events Manager

unaffected

Version	Status	Constraints
`0`	affected	≤ 7.3.6

No data.

Vendor Product Versions

Marcus (aka @msykes)

Events Manager

Version	Status	Scheme	Platform
`[0,7.3.6]`	affected	semver	—
`[7.3.7,*]`	unaffected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Events Manager plugin update (7.3.7 or newer) to eliminate the deserialization flaw.
Restrict unauthorized use of the plugin by limiting user roles or disabling unnecessary REST endpoints that could be abused.
Deploy a web application firewall or equivalent security layer to detect and block malicious deserialization attempts.

Generated by OpenCVE AI on July 31, 2026 at 11:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.461% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-3-6-php-object-injection-vulnerability?_s_id=cve

History

Jul 13, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 13, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Marcus (aka @msykes) Marcus (aka @msykes) events Manager Wordpress Wordpress wordpress
Vendors & Products		Marcus (aka @msykes) Marcus (aka @msykes) events Manager Wordpress Wordpress wordpress

Jul 13, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
Title		WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability
Weaknesses		CWE-502
References		https://patchstack.com/database/Wordpress/Plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-3-6-php-object-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`