The vulnerability is a deserialization flaw that allows untrusted data to be turned into PHP objects, leading to object injection. An attacker who can supply crafted serialized input can create objects that execute arbitrary code on the server. This flaw can compromise confidentiality, integrity, and availability of the affected system, potentially giving full control over the host.

The flaw affects the WordPress WpTravelly tour‑booking‑manager plugin from undefined earlier releases through version 1.8.7. The plugin is maintained by the magepeopleteam. No specific CPE strings are listed, but the impact is limited to installations using versions up to and including 1.8.7.

The CVSS score of 8.8 classifies this as High severity. Exploit likelihood, as indicated by an EPSS score of less than 1%, is low, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors would involve web-based interaction with the plugin’s serialization handling—such as form submissions or data imports—where an attacker can inject a malicious payload. Successful exploitation would provide remote code execution privileges on the server.