EUVD-2026-89912
GHSA-72mh-3555-vj62
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization (AV:N/AC:L/PR:N/UI:N); C/I/A:H reflects full compromise assuming an exploitable gadget chain, consistent with the stated vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
AnalysisAI
Unauthenticated PHP object injection (CWE-502) in the WordPress plugin Booking Activities, affecting versions through 1.18.7.1, allows remote attackers to reach plugin endpoints and pass attacker-controlled data into PHP unserialize() with no authentication or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Potential impact includes code execution, file read/write, or denial of service, but real-world severity depends on the presence of a usable POP gadget chain in the plugin, WordPress core, or another loaded plugin/theme. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching a Booking Activities endpoint that passes attacker-controlled input into PHP unserialize() on a WordPress site running the plugin at version <= 1.18.7.1; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against a default installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input assigns CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, no privileges, no user interaction, mapping to CWE-502 unauthenticated PHP Object Injection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The affected range is Booking Activities <= 1.18.7.1, and the provided data does not specify an exact fixed version, so upgrade the plugin to the latest release above 1.18.7.1 and verify the fix against the vendor advisory at https://patchstack.com/database/wordpress/plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-18-7-1-php-object-injection-vulnerability?_s_id=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify if Booking Activities version 1.18.7.1 or earlier is present; if the plugin is not business-critical, disable and remove it immediately, and if it must remain, deploy a web application firewall (WAF) rule to block malicious serialized payloads targeting plugin endpoints and restrict access to those endpoints via IP allowlisting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today