Deserialization of Untrusted Data in the Booking and Rental Manager plugin for WooCommerce permits PHP Object Injection. The vulnerability allows an attacker to manipulate the serialized data stream accepted by the plugin to instantiate malicious objects that can execute arbitrary code on the web server. This flaw is identified as CWE‑502 and can compromise confidentiality, integrity, and availability of the WordPress site.

Magepeopleteam’s Booking and Rental Manager plugin for WooCommerce, versions up to and including 2.2.6, is affected. Any WordPress installation that has this plugin enabled with a vulnerable version is at risk.

The CVSS score of 8.8 indicates a high severity level. The EPSS score of less than 1% suggests that, as of the latest assessment, exploitation is uncommon, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is likely through user‑controlled input that contains serialized data, such as form submissions or URL parameters, allowing remote code execution if the attacker can deliver crafted payloads to the plugin’s endpoints.