Exploitation Research Plan: CVE-2026-57713 (Events Manager)

1. Vulnerability Summary

The Events Manager plugin (versions <= 7.3.6) is vulnerable to **Unauthenticated PHP Object Injection**. The vulnerability exists in the handling of a REST API endpoint introduced for Gutenberg block validation. Specifically, the endpoint /events-manager/v1/blocks/event/validate accepts a form_data parameter which is a serialized string of form inputs. The server-side logic parses this string and subsequently passes the resulting data to functions that perform deserialization (unserialize()) on certain keys without proper validation or using the allowed_classes => false option.

Because the permission_callback for this REST route is either missing or defaults to __return_true, the endpoint is accessible to unauthenticated attackers.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/events-manager/v1/blocks/event/validate
• Vulnerable Parameter: form_data
• Payload Parameter (inside form_data): Likely event_attributes or recurrence_data.
• Authentication: Unauthenticated (PR:N).
• Preconditions: The plugin must be active. The site must have the REST API enabled (default in WordPress).

3. Code Flow

1. Registration: EM_Blocks::init() in blocks/_bootstrap.php calls add_action( 'rest_api_init', [ __CLASS__, 'register_validation_endpoint' ] );.
2. Route Definition: EM_Blocks::register_validation_endpoint() (inferred) registers the route /events-manager/v1/blocks/event/validate with permission_callback => '__return_true'.
3. Entry Point: An attacker sends a POST request to the endpoint with post_type, post_id, and form_data.
4. Parsing: The server-side callback parses the form_data string (likely using parse_str()).
5. Processing: The parsed parameters are used to instantiate or populate an EM_Event or EM_Location object (e.g., via $EM_Event->get_post($params)).
6. Sink: Inside the object's data handling logic (likely in classes/em-event.php or classes/em-location.php), certain fields (e.g., event_attributes or recurring_data) are passed to unserialize().

4. Nonce Acquisition Strategy

The vulnerability is reported as Unauthenticated. In the WordPress REST API, if a route's permission_callback returns true, no authentication is required.

• REST Nonce (_wpnonce): WordPress only enforces the REST nonce check if the request contains authentication cookies (to prevent CSRF against logged-in users). If the request is sent without cookies, the nonce check is skipped for unauthenticated routes.
• Action Nonce (_emnonce): The plugin logic might check for an internal nonce (like _emnonce seen in the JS source). However, if the validation endpoint is intended for draft saves or pre-flight checks, this check may be bypassed or the nonce may be available on the frontend.

Strategy:

1. Attempt the exploit without a nonce and without cookies first.
2. If the server returns a 403 Forbidden with a "rest_cookie_invalid_nonce" error, it means the environment requires a nonce even for unauthenticated users.
3. To obtain a nonce:
   • Create a page with an Events Manager block or shortcode: wp post create --post_type=page --post_status=publish --post_content='[event_form]'
   • Navigate to the page and use browser_eval to extract the nonce:

     // Example based on common EM localization patterns
     window.EM?.nonce || window.em_ajax?.nonce
     

5. Exploitation Strategy

Step 1: Verification of Endpoint

Send a benign request to confirm the endpoint exists and is accessible.

• Method: POST
• URL: `/wp-json/events-manager/v1/blocks/