Description
Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
Published: 2026-07-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Events Manager plugin for WordPress deserializes input from untrusted sources, enabling PHP Object Injection in versions up to 7.3.6. According to CWE-502, this flaw can let an attacker execute arbitrary PHP code on the host, compromising the confidentiality, integrity, and availability of the affected site.

Affected Systems

All WordPress sites running the Events Manager plugin version 7.3.6 or earlier are affected. The vendor, Marcus (also known as @msykes), released the affected product, the Events Manager plugin, for all releases through 7.3.6.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector is a remote web request containing crafted serialized data that reaches the plugin's vulnerable deserialization routine.

Generated by OpenCVE AI on July 31, 2026 at 11:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Events Manager plugin update (7.3.7 or newer) to eliminate the deserialization flaw.
  • Restrict unauthorized use of the plugin by limiting user roles or disabling unnecessary REST endpoints that could be abused.
  • Deploy a web application firewall or equivalent security layer to detect and block malicious deserialization attempts.

Generated by OpenCVE AI on July 31, 2026 at 11:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Marcus (aka @msykes)
Marcus (aka @msykes) events Manager
Wordpress
Wordpress wordpress
Vendors & Products Marcus (aka @msykes)
Marcus (aka @msykes) events Manager
Wordpress
Wordpress wordpress

Mon, 13 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
Title WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Marcus (aka @msykes) Events Manager
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-13T14:38:45.658Z

Reserved: 2026-06-25T08:04:04.790Z

Link: CVE-2026-57713

cve-icon Vulnrichment

Updated: 2026-07-13T13:59:05.485Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T12:00:05Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data