What is the CVSS score of EUVD-2026-57959?

EUVD-2026-57959 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Booking Activities are affected by EUVD-2026-57959?

The Booking Activities WordPress plugin (versions 1.18.4 and earlier) contains a critical remote code execution vulnerability that could allow attackers to fully compromise affected websites.

How to fix or mitigate EUVD-2026-57959?

Within 24 hours: Identify all WordPress installations using Booking Activities plugin version 1.18.4 or earlier using automated scanning or WordPress admin console. Within 7 days: Disable the plugin on all affected systems if business operations permit, or implement network-level access restrictions to the booking functionality while awaiting a vendor patch. Within 30 days: Monitor the Booking Activities plugin repository for a released patch; immediately apply version 1.18.5 or later once available, or migrate to an alternative booking solution if the vendor does not release a timely fix.

Booking Activities EUVD-2026-57959

| CVE-2026-28176 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-13 Patchstack

GHSA-mc9r-rc7r-x444

PHP WordPress Deserialization Wordpress Plugin Booking Activities

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable front-end input, no auth required, but user interaction needed to trigger deserialization; full CIA impact if POP chain available.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:52 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

AnalysisAI

PHP Object Injection in the Booking Activities WordPress plugin (versions ≤ 1.18.4) exposes sites to potential remote code execution through unsafe deserialization of attacker-controlled data. The CVSS vector (PR:N, UI:R) indicates exploitation requires no authentication but does require some form of user interaction, suggesting the attack surface likely involves a front-end booking form or link that a visitor triggers. Depending on available PHP class chains (POP chains) in the WordPress environment, impact can reach full confidentiality, integrity, and availability compromise. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) is the root cause class. PHP's native unserialize() function, when fed attacker-controlled input, instantiates arbitrary PHP objects and invokes magic methods (__wakeup, __destruct, __toString, etc.) on whatever classes are loaded in the runtime. WordPress installations carry a large class surface - including popular plugins and themes - which significantly increases the probability of a viable Property-Oriented Programming (POP) chain being present. The affected product is identified by CPE cpe:2.3:a:booking_activities_team:booking_activities:*:*:*:*:*:*:*:* covering all versions through 1.18.4. The vulnerability was disclosed by Patchstack.

RemediationAI

The primary remediation is to upgrade Booking Activities to a version above 1.18.4. The exact patched release version is not independently confirmed from the available intelligence data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-18-4-php-object-injection-vulnerability and the WordPress plugin repository for the current patched release. If an immediate upgrade is not possible, consider disabling the plugin entirely as a compensating control (trade-off: booking functionality will be unavailable). As an additional layer, a web application firewall (WAF) rule blocking serialized PHP payloads in request parameters can reduce exploitation risk but is not a substitute for patching, as filter bypass techniques exist.