[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fw3DIW_H97e7ZIhzzEjeEeNLkKjdrFlKLba4DZktBwbE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57713","events-manager-calendar-bookings-tickets-and-more-unauthenticated-php-object-injection","Events Manager – Calendar, Bookings, Tickets, and more! \u003C= 7.3.6 - Unauthenticated PHP Object Injection","The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 7.3.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","events-manager",null,"\u003C=7.3.6","7.3.7","high",8.1,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Deserialization of Untrusted Data","2026-07-08 00:00:00","2026-07-14 19:37:42",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F855f3030-3d0b-4886-8d40-a2245a787ab4?source=api-prod",7,[22,23,24,25,26,27,28,29],"admin\u002Fem-admin.php","admin\u002Fsettings\u002Ftabs\u002Fgeneral.php","blocks\u002F_bootstrap.php","blocks\u002Fbuild\u002Fevent-when\u002Fblock.json","blocks\u002Fbuild\u002Fevent-when\u002Findex.asset.php","blocks\u002Fbuild\u002Fevent-when\u002Findex.js","blocks\u002Fbuild\u002Fgutenberg-validation\u002Findex.asset.php","blocks\u002Fbuild\u002Fgutenberg-validation\u002Findex.js","researched",false,3,"# Exploitation Research Plan: CVE-2026-57713 (Events Manager)\n\n## 1. Vulnerability Summary\nThe **Events Manager** plugin (versions \u003C= 7.3.6) is vulnerable to **Unauthenticated PHP Object Injection**. The vulnerability exists in the handling of a REST API endpoint introduced for Gutenberg block validation. Specifically, the endpoint `\u002Fevents-manager\u002Fv1\u002Fblocks\u002Fevent\u002Fvalidate` accepts a `form_data` parameter which is a serialized string of form inputs. The server-side logic parses this string and subsequently passes the resulting data to functions that perform deserialization (`unserialize()`) on certain keys without proper validation or using the `allowed_classes => false` option.\n\nBecause the `permission_callback` for this REST route is either missing or defaults to `__return_true`, the endpoint is accessible to unauthenticated attackers.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `POST \u002Fwp-json\u002Fevents-manager\u002Fv1\u002Fblocks\u002Fevent\u002Fvalidate`\n*   **Vulnerable Parameter:** `form_data`\n*   **Payload Parameter (inside `form_data`):** Likely `event_attributes` or `recurrence_data`.\n*   **Authentication:** Unauthenticated (PR:N).\n*   **Preconditions:** The plugin must be active. The site must have the REST API enabled (default in WordPress).\n\n## 3. Code Flow\n1.  **Registration:** `EM_Blocks::init()` in `blocks\u002F_bootstrap.php` calls `add_action( 'rest_api_init', [ __CLASS__, 'register_validation_endpoint' ] );`.\n2.  **Route Definition:** `EM_Blocks::register_validation_endpoint()` (inferred) registers the route `\u002Fevents-manager\u002Fv1\u002Fblocks\u002Fevent\u002Fvalidate` with `permission_callback => '__return_true'`.\n3.  **Entry Point:** An attacker sends a `POST` request to the endpoint with `post_type`, `post_id`, and `form_data`.\n4.  **Parsing:** The server-side callback parses the `form_data` string (likely using `parse_str()`).\n5.  **Processing:** The parsed parameters are used to instantiate or populate an `EM_Event` or `EM_Location` object (e.g., via `$EM_Event->get_post($params)`).\n6.  **Sink:** Inside the object's data handling logic (likely in `classes\u002Fem-event.php` or `classes\u002Fem-location.php`), certain fields (e.g., `event_attributes` or `recurring_data`) are passed to `unserialize()`.\n\n## 4. Nonce Acquisition Strategy\nThe vulnerability is reported as **Unauthenticated**. In the WordPress REST API, if a route's `permission_callback` returns `true`, no authentication is required. \n*   **REST Nonce (`_wpnonce`):** WordPress only enforces the REST nonce check if the request contains authentication cookies (to prevent CSRF against logged-in users). If the request is sent without cookies, the nonce check is skipped for unauthenticated routes.\n*   **Action Nonce (`_emnonce`):** The plugin logic might check for an internal nonce (like `_emnonce` seen in the JS source). However, if the validation endpoint is intended for draft saves or pre-flight checks, this check may be bypassed or the nonce may be available on the frontend.\n\n**Strategy:**\n1.  Attempt the exploit **without a nonce** and **without cookies** first.\n2.  If the server returns a `403 Forbidden` with a \"rest_cookie_invalid_nonce\" error, it means the environment requires a nonce even for unauthenticated users.\n3.  To obtain a nonce:\n    - Create a page with an Events Manager block or shortcode: `wp post create --post_type=page --post_status=publish --post_content='[event_form]'`\n    - Navigate to the page and use `browser_eval` to extract the nonce:\n      ```javascript\n      \u002F\u002F Example based on common EM localization patterns\n      window.EM?.nonce || window.em_ajax?.nonce\n      ```\n\n## 5. Exploitation Strategy\n\n### Step 1: Verification of Endpoint\nSend a benign request to confirm the endpoint exists and is accessible.\n*   **Method:** `POST`\n*   **URL:** `\u002Fwp-json\u002Fevents-manager\u002Fv1\u002Fblocks\u002F","gemini-3-flash-preview","2026-07-16 14:28:22","2026-07-16 14:30:10",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","7.3.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevents-manager\u002Ftags\u002F7.3.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevents-manager.7.3.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevents-manager\u002Ftags\u002F7.3.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fevents-manager.7.3.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fevents-manager\u002Ftags"]