EUVD-2026-42178
GHSA-5jfm-f958-c6pr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network object injection (AV:N/PR:N/UI:N) with total impact if RCE achieved, but AC:H because code execution depends on a suitable gadget chain being present on the target site.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
Articles & Coverage 1
AnalysisAI
PHP object injection in the Appointment Booking Calendar and Scheduling Plugin for WordPress (all versions through 1.1.28) lets unauthenticated attackers pass attacker-controlled data into a PHP deserialization call, and where a suitable gadget chain exists on the site this can be escalated to remote code execution. Reported by WPScan with publicly available exploit detail, though EPSS is low (0.23%, 13th percentile) and CISA SSVC records no observed exploitation, so this is a proof-of-concept-grade risk rather than confirmed active exploitation. Impact is total (confidentiality, integrity, availability) when a gadget chain is present, but the high attack complexity reflects that dependency.
Technical ContextAI
The vulnerability is a classic PHP Object Injection (root-cause class CWE-502, Deserialization of Untrusted Data - note the source feed lists CWE as N/A). WordPress plugins commonly call PHP's unserialize() on request-supplied data; because unserialize() reconstructs arbitrary object instances, an attacker who controls the serialized string can force instantiation of any class the application autoloads, then abuse that object's magic methods (__wakeup, __destruct, __toString) to trigger a 'gadget chain'. The affected component is the Appointment Booking Calendar and Scheduling Plugin (CPE cpe:2.3:a:unknown:appointment_booking_calendar_plugin_and_scheduling_plugin:*), which fails to validate or type-check data before deserialization. Whether object injection reaches code execution depends on gadgets available in WordPress core, the plugin, or other installed plugins/themes on the target site.
RemediationAI
Upgrade the Appointment Booking Calendar Plugin and Scheduling Plugin to a release later than 1.1.28 once the author publishes a fixed version; the available data confirms vulnerable versions through 1.1.28 but does not include an exact fixed version number, so verify the patched release on the plugin's WordPress.org page or via the WPScan advisory (https://wpscan.com/vulnerability/eb3abb88-43c3-42a8-a8a8-2ad67d37e020/) before deploying - do not assume a specific version. If no patched version is yet available, apply compensating controls: place a WAF rule to block requests whose parameters contain PHP serialized-object markers (e.g. 'O:' followed by a digit and a colon, or '__PHP_Incomplete_Class'), restrict access to the plugin's request-handling endpoints (including admin-ajax.php actions and any REST routes it registers) to trusted sources, or deactivate and remove the plugin entirely until a fix ships. Note trade-offs: deactivating the plugin removes booking/scheduling functionality from the site, and WAF signature matching on serialized data can produce false positives against legitimate serialized payloads used elsewhere.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today