A critical vulnerability in the Events Manager WordPress plugin allows unauthenticated attackers to extract sensitive database information, including password hashes and secret keys.

The flaw stems from the insecure deserialization of booker-supplied registration data, which facilitates PHP object injection. When combined with an unauthenticated SQL injection vulnerability, it allows an unauthenticated attacker to bypass security controls and exfiltrate sensitive data from the underlying database.

The CVSS score of 7.5 indicates a high-severity risk, primarily due to the lack of required authentication. A successful exploit could lead to full database compromise, including the theft of administrative credentials, user password hashes, and WordPress secret keys. Such a breach could result in total site takeover, severe reputational damage, and a significant loss of confidentiality for all registered users.

Immediate Action: Update the Events Manager plugin to version 7.3.7 or later immediately to resolve the insecure deserialization and SQL injection flaws.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, particularly those originating from booking-related endpoints or containing serialized PHP objects.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious serialized PHP strings and common SQL injection patterns until the plugin can be updated.

Public Exploit Available: Yes, public proof-of-concept exploit code is available.

Given the confirmed active exploitation of this vulnerability and the ease with which an unauthenticated attacker can compromise sensitive database information, this issue must be treated as a high-priority incident. Administrators should verify the current plugin version and apply the 7.3.7 update across all affected WordPress installations without delay to prevent potential data exfiltration and unauthorized access.