Description

Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T10:16:36.750Z",
  "pubdate": "2026-08-27T10:16:36.750Z",
  "executiveSummary": "The Booking and Rental Manager plugin, in versions 2.7.5 and below, contains a critical PHP Object Injection vulnerability. This flaw arises from improper sanitization of user-supplied input that is subsequently passed to PHP's unserialize() function.\nA vulnerability of this nature poses a severe security risk, potentially allowing an authenticated attacker with contributor-level privileges to achieve Remote Code Execution (RCE), arbitrary file deletion, or other unauthorized actions depending on the available gadget chains present within the application's environment.\nExploitation requires the attacker to be authenticated to the WordPress instance, specifically with at least contributor-level access. By crafting a malicious serialized object, an attacker can manipulate the application's internal state when the unserialization process occurs. This vulnerability could lead to a full compromise of the affected WordPress site, as arbitrary PHP code execution often facilitates lateral movement, data exfiltration, or complete system takeover.\nGiven the severity, prompt remediation is required to prevent unauthorized exploitation of the plugin's insecure deserialization handlers.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of PHP's unserialize() function within the Booking and Rental Manager plugin, affecting versions 2.7.5 and below. PHP Object Injection occurs when an application deserializes untrusted user input without adequate validation or sanitization. In this scenario, the plugin accepts user-controlled data—often passed via POST parameters or specific plugin hooks—and processes it through unserialize().\nTo exploit this, an attacker must identify or develop a 'gadget chain.' A gadget chain consists of existing classes within the application or its environment (including the WordPress core, the theme, or other installed plugins) that possess magic methods such as __destruct(), __wakeup(), or __toString(). When these objects are instantiated during the unserialization process, the magic methods are triggered automatically. By chaining these methods together, an attacker can manipulate the behavior of the application's runtime environment.\nThe attack flow proceeds as follows: First, the attacker, possessing at least contributor-level privileges, identifies the vulnerable parameter or endpoint that feeds serialized data into an unserialize() call. Second, the attacker constructs a malicious serialized payload designed to leverage available gadget chains. This payload often involves setting specific properties on objects that, when manipulated, allow for actions like arbitrary file operations or the instantiation of classes capable of executing arbitrary PHP code (e.g., via call_user_func or similar dangerous functions).\nThird, the attacker sends the crafted payload to the vulnerable endpoint. Upon processing, the server unserializes the malicious object, triggering the gadget chain. If successful, this leads to the intended impact, such as Remote Code Execution, enabling the attacker to execute arbitrary commands on the underlying server, bypassing security restrictions imposed by the application. This vulnerability is particularly dangerous because it bypasses standard input validation mechanisms, as the malicious behavior is triggered during the reconstruction of the object structure itself, not merely through the data content.\nBecause the vulnerability requires authenticated access, the threat profile is limited to authorized users; however, in environments where contributor account security is weak or accounts are compromised via phishing or credential stuffing, this vulnerability provides a direct pathway to full system compromise. The network exposure is broad, as any accessible WordPress installation with this plugin is susceptible if the required privilege level is obtained by an attacker."
}