The Events Manager WordPress plugin versions prior to 7.3.7 do not properly sanitize booking-registration data when operating in No-User-Account Booking Mode. Specifically, a registration field supplied by the booker is stored as booking meta and later deserialized without restricting allowed PHP classes, which enables PHP object injection. This injection facilitates a gadget chain culminating in a database query that lacks parameterization, allowing an unauthenticated attacker to read arbitrary data from the database, including sensitive credentials and secret keys.

An unauthenticated attacker can exploit this vulnerability to read arbitrary database data, including sensitive information such as user password hashes and secret keys. This compromises the confidentiality of the affected system's data and could lead to further attacks if the exposed credentials or keys are used elsewhere.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor the vendor's announcements for updates and apply any official patches once released. Until then, consider disabling No-User-Account Booking Mode if feasible or restricting access to booking functionality to trusted users.