Booktics EUVD-2026-41364

Exploitation requires the Booktics plugin (version <= 1.0.21) to be installed and active on a network-reachable WordPress site, with an attacker-reachable code path that passes untrusted input into PHP's unserialize(). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against a default installation. The key limiting factor is that impact beyond object instantiation depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin - without such a chain the injection may not achieve RCE, so realistic risk varies with each target's specific plugin/theme mix.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact - a top-priority profile on paper. However, the real-world impact of PHP Object Injection is conditional on the presence of an exploitable POP gadget chain; where none exists in the deployed stack, practical impact can be substantially lower than the 9.8 implies. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. Net assessment: treat as high priority for patching given the unauthenticated network vector and Patchstack sourcing, but recognize that the 9.8 assumes a reachable gadget chain that is not confirmed in the available data.

An unauthenticated attacker sends a crafted HTTP request to a Booktics endpoint containing a serialized PHP object string in a parameter that the plugin passes to unserialize(). When deserialized, the injected object triggers magic methods that, combined with an available gadget chain in WordPress or an active plugin, lead to arbitrary file operations or code execution. No public exploit was identified at time of analysis, and successful code execution depends on a reachable POP gadget in the target's stack.