What is the CVSS score of CVE-2026-57621?

CVE-2026-57621 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Booktics are affected by CVE-2026-57621?

The Booktics WordPress plugin (versions 1.0.21 and earlier) contains a critical unauthenticated code injection flaw (CVSS 9.8) that allows attackers to execute arbitrary PHP code and completely…

How to fix or mitigate CVE-2026-57621?

24 hours: Disable and deactivate the Booktics plugin across all WordPress installations via admin panel or file removal; inventory affected sites. 7 days: Request patch timeline from Arraytics; implement WAF rules blocking /wp-content/plugins/booktics/ traffic; evaluate alternative ticketing solutions with published security records. 30 days: Migrate to patched alternative plugin or deploy version 1.0.22+ (when released with confirmed fixes); audit WordPress logs for exploitation attempts; validate no backdoors remain from prior exposure.

Booktics CVE-2026-57621

EUVD-2026-41364 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-02 Patchstack

GHSA-p7cq-jc3q-mqj2

PHP WordPress Deserialization Booktics Wordpress Plugin Arraytics

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization justifies AV:N/AC:L/PR:N/UI:N; high C/I/A reflects potential RCE, though this assumes a reachable POP gadget chain.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:01 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

Articles & Coverage 1

News Critical PHP Object Injection in Booktics WordPress Plugin - CVE-2026-57621 Jul 03, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controlled input into PHP's unserialize() without validation. In WordPress plugins this typically happens when serialized data from a request parameter, cookie, or stored option is deserialized, causing PHP to instantiate arbitrary objects. On its own, object injection only triggers PHP magic methods (__wakeup, __destruct, __toString) on attacker-defined objects; meaningful impact requires chaining these into a gadget that performs a dangerous action (file write, SQL query, code execution). The affected component is the Booktics appointment/booking plugin (CPE cpe:2.3:a:arraytics:booktics), a PHP application running inside WordPress, so the combined plugin+core+theme class surface is available for gadget chaining.

RemediationAI

No vendor-released patch version is identified in the available data; the advisory only confirms that versions through 1.0.21 are vulnerable, so upgrade to the latest Booktics release above 1.0.21 once the vendor publishes a fix and verify the changelog addresses this issue (reference: the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-21-php-object-injection-vulnerability). Until a confirmed patch exists, the most effective compensating control is to deactivate and remove the Booktics plugin, which fully eliminates the vulnerable code but disables booking functionality; if the plugin must remain active, deploy a WAF rule (e.g., Patchstack virtual patching or equivalent) to block requests containing PHP serialized-object markers such as 'O:' patterns aimed at the plugin's endpoints, accepting occasional false positives, and restrict access to the affected endpoints where public booking is not required.