Description

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T14:16:59.663Z",
  "pubdate": "2026-08-13T14:16:59.663Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Booking Activities plugin for WordPress, affecting versions up to 1.18.4.\nThis security flaw allows remote, unauthenticated attackers to supply maliciously crafted serialized objects to vulnerable entry points within the application.\nSuccessful exploitation of this vulnerability can lead to severe security implications, including arbitrary file operations, SQL injection, or remote code execution depending on the presence of compatible gadget chains within the application context or available third-party plugins and themes.\nThe core risk stems from the insecure deserialization of untrusted user input without proper validation or sanitization.\nAttackers do not require any prior authentication or privileged access to trigger the flaw, making it exploitable over the network by any external adversary able to interact with the target WordPress site.\nRemediation requires updating the Booking Activities plugin to a patched version beyond 1.18.4 where input handling and object deserialization mechanisms are properly secured.",
  "technicalDetails": "The vulnerability exists within the Booking Activities plugin up to version 1.18.4 due to the insecure handling and processing of user-supplied data that is eventually passed into PHP's native unserialize() function or an equivalent insecure deserialization mechanism.\nPHP Object Injection is an application-level vulnerability that occurs when untrusted user input is insecurely deserialized by the application.\nIn PHP, the unserialize() function converts a serialized string back into its original variable or object structure.\nIf user-supplied input is directly passed to this function without adequate validation, an attacker can manipulate the serialized data to instantiate arbitrary classes existing within the PHP scope.\nThe attack flow begins when an unauthenticated adversary sends a specially crafted HTTP request containing a serialized payload targeting a vulnerable parameter or endpoint handled by the Booking Activities plugin.\nUpon processing the request, the application deserializes the malicious payload, triggering PHP magic methods such as __wakeup() or __destruct() within the instantiated classes.\nIf the application or its dependent libraries contain vulnerable gadget chains—classes with magic methods that perform dangerous operations using object properties—the attacker can leverage these chains to achieve secondary impacts.\nDepending on the available gadget chains present in the environment, potential post-exploitation impact ranges from arbitrary file deletion, reading sensitive files, executing arbitrary SQL queries, to complete remote code execution on the underlying web server.\nThe vulnerability is exposed over the network via standard HTTP/HTTPS protocols and requires no authentication or specific privileges, lowering the barrier to exploitation for external threat actors."
}