What the vulnerability does
01Description
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.9 via deserialization via shortcode of untrusted input from a custom meta value. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
The Event Monster plugin for WordPress contains a deserialization vulnerability in versions up to 1.3.9. An authenticated attacker with low privileges can send a specially crafted request to deserialize untrusted data, potentially allowing them to read sensitive site data, modify content, or disrupt site availability. The attack requires network access and some technical knowledge but no user interaction.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or crash the site by deserializing malicious data.
Potential impact on your site
04Site Impact
Confidential data exposure, unauthorized content changes, or site downtime if the plugin is active.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
April 30, 2024
CVE published
April 8, 2026
Record updated
