Booking Activities
Monthly
PHP Object Injection in the Booking Activities WordPress plugin (versions ≤ 1.18.4) exposes sites to potential remote code execution through unsafe deserialization of attacker-controlled data. The CVSS vector (PR:N, UI:R) indicates exploitation requires no authentication but does require some form of user interaction, suggesting the attack surface likely involves a front-end booking form or link that a visitor triggers. Depending on available PHP class chains (POP chains) in the WordPress environment, impact can reach full confidentiality, integrity, and availability compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Booking Activities WordPress plugin (versions up to and including 1.16.48.1) enables unauthenticated remote attackers to perform restricted booking-related operations without authorization. Rooted in CWE-862 (Missing Authorization), the flaw bypasses access controls at the network level with no privileges or user interaction required, resulting in low-severity integrity and availability impacts - likely allowing unauthorized creation, modification, or cancellation of bookings. No public exploit code or CISA KEV listing has been identified at time of analysis.
PHP Object Injection in the Booking Activities WordPress plugin (versions ≤ 1.18.4) exposes sites to potential remote code execution through unsafe deserialization of attacker-controlled data. The CVSS vector (PR:N, UI:R) indicates exploitation requires no authentication but does require some form of user interaction, suggesting the attack surface likely involves a front-end booking form or link that a visitor triggers. Depending on available PHP class chains (POP chains) in the WordPress environment, impact can reach full confidentiality, integrity, and availability compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Booking Activities WordPress plugin (versions up to and including 1.16.48.1) enables unauthenticated remote attackers to perform restricted booking-related operations without authorization. Rooted in CWE-862 (Missing Authorization), the flaw bypasses access controls at the network level with no privileges or user interaction required, resulting in low-severity integrity and availability impacts - likely allowing unauthorized creation, modification, or cancellation of bookings. No public exploit code or CISA KEV listing has been identified at time of analysis.