EUVD-2026-42178
GHSA-5jfm-f958-c6pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliveryCraft malicious serialized PHP object
-
ExploitSubmit via unauthenticated request
-
ExecutionPlugin deserializes untrusted input
-
PersistInjected object triggers gadget chain
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires reaching the plugin code path that passes unvalidated request data into a PHP deserialization function - no authentication is needed (PR:N), no user interaction is needed (UI:N), and it is exploitable remotely over the network (AV:N) against sites running the plugin at version 1.1.28 or earlier. The decisive limiting factor is that object injection only escalates to remote code execution when a suitable PHP gadget chain (via magic methods in WordPress core, this plugin, or another installed plugin/theme) is present on the target - this is exactly why the CVSS carries AC:H. Absent a usable gadget, the attacker still achieves arbitrary PHP object injection, which may enable lesser impacts such as data tampering or denial of service depending on available classes. |
| Impact | Signals conflict and must be weighed carefully. CVSS 3.1 is 8.1 (High) with AV:N/AC:H/PR:N/UI:N and total C/I/A impact - network-reachable and unauthenticated, but AC:H captures that RCE only follows if a usable gadget chain is present. Against that high score, EPSS is only 0.23% (13th percentile) and CISA SSVC reports Exploitation: none and Automatable: no, while rating Technical Impact: total. A public POC exists (WPScan), but POC availability is not active exploitation and this CVE is not on CISA KEV. Net assessment: real and worth prioritizing for sites running this plugin because the entry point is unauthenticated and impact is total, but the gadget-chain prerequisite and low EPSS/SSVC 'automatable: no' indicate opportunistic mass exploitation is currently unlikely - treat as a high-priority patch, not an emergency-only-if-KEV item. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts an HTTP request to a plugin endpoint, embedding a malicious PHP-serialized object string in a parameter that the plugin passes to unserialize(). If the target site loads a class whose magic methods form a usable gadget chain, the injected object triggers that chain during deserialization to run attacker-chosen code or file/database operations. A public POC from WPScan lowers the barrier, though the high CVSS complexity reflects that success hinges on a suitable gadget being present on the specific site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
PHP object injection in the Appointment Booking Calendar and Scheduling Plugin for WordPress (all versions through 1.1.28) lets unauthenticated attackers pass attacker-controlled data into a PHP deserialization call, and where a suitable gadget chain exists on the site this can be escalated to remote code execution. Reported by WPScan with publicly available exploit detail, though EPSS is low (0.23%, 13th percentile) and CISA SSVC records no observed exploitation, so this is a proof-of-concept-grade risk rather than confirmed active exploitation. Impact is total (confidentiality, integrity, availability) when a gadget chain is present, but the high attack complexity reflects that dependency.
RemediationAI
Upgrade the Appointment Booking Calendar Plugin and Scheduling Plugin to a release later than 1.1.28 once the author publishes a fixed version; the available data confirms vulnerable versions through 1.1.28 but does not include an exact fixed version number, so verify the patched release on the plugin's WordPress.org page or via the WPScan advisory (https://wpscan.com/vulnerability/eb3abb88-43c3-42a8-a8a8-2ad67d37e020/) before deploying - do not assume a specific version. If no patched version is yet available, apply compensating controls: place a WAF rule to block requests whose parameters contain PHP serialized-object markers (e.g. 'O:' followed by a digit and a colon, or '__PHP_Incomplete_Class'), restrict access to the plugin's request-handling endpoints (including admin-ajax.php actions and any REST routes it registers) to trusted sources, or deactivate and remove the plugin entirely until a fix ships. Note trade-offs: deactivating the plugin removes booking/scheduling functionality from the site, and WAF signature matching on serialized data can produce false positives against legitimate serialized payloads used elsewhere.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic PHP Object Injection (root-cause class CWE-502, Deserialization of Untrusted Data - note the source feed lists CWE as N/A). WordPress plugins commonly call PHP's unserialize() on request-supplied data; because unserialize() reconstructs arbitrary object instances, an attacker who controls the serialized string can force instantiation of any class the application autoloads, then abuse that object's magic methods (__wakeup, __destruct, __toString) to trigger a 'gadget chain'. The affected component is the Appointment Booking Calendar and Scheduling Plugin (CPE cpe:2.3:a:unknown:appointment_booking_calendar_plugin_and_scheduling_plugin:*), which fails to validate or type-check data before deserialization. Whether object injection reaches code execution depends on gadgets available in WordPress core, the plugin, or other installed plugins/themes on the target site.
Know when Appointment Booking Calendar Plugin And Scheduling Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network object injection (AV:N/PR:N/UI:N) with total impact if RCE achieved, but AC:H because code execution depends on a suitable gadget chain being present on the target site.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
Articles & Coverage 1
Executive ViewAI
The Appointment Booking Calendar plugin for WordPress (all versions through 1.1.28) allows unauthenticated remote attackers to inject and execute malicious code on affected servers. This threatens any organization using this plugin for customer scheduling-enabling attackers to steal customer data, modify bookings, deface websites, or install malware. With publicly available exploit code and no current patch, immediate remediation is required to protect customer trust and business operations.
No vendor-released patch identified at time of analysis. Interim mitigations include: immediately disable the plugin in production; implement network-level access controls and firewall rules restricting WordPress installation access; deploy WAF rules to block PHP object injection payloads; monitor system and application logs for exploitation attempts; and evaluate migration to a maintained, actively-supported scheduling plugin. These compensating controls are temporary pending patch availability from the vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB