The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the Taxi Booking Manager for WooCommerce plugin. Attackers can craft malicious serialized payloads that are executed by the plugin when deserialized, potentially allowing them to execute arbitrary code on the WordPress site. This weakness corresponds to CWE‑502 and carries a CVSS score of 8.8, indicating a high‑severity risk to confidentiality, integrity, and availability.

The affected product is the Taxi Booking Manager for WooCommerce plugin from the Magepeopleteam team, used within WordPress. All releases up to and including version 1.1.8 are vulnerable. No lower bound is specified, meaning any installed instance of the plugin that is version 1.1.8 or earlier is at risk.

Although the EPSS score is under 1 % and the vulnerability is not listed in the CISA KEV catalog, its CVSS of 8.8 indicates that exploitation would be highly damaging if it occurred. The likely attack vector involves HTTP requests that send serialized data to the plugin’s endpoints; the plugin does not properly validate or sanitise this input. Consequently, a remote attacker could send a crafted payload through the web interface or via an API to trigger object injection and gain control over the server.