The vulnerability exists in the TuriTop Booking System plugin for WordPress. Deserialization of untrusted data allows an attacker to inject arbitrary PHP objects, which can lead to remote code execution or other severe impacts. This flaw is defined by CWE‑502 and is scored 8.8 on the CVSS scale, indicating a high likelihood of exploitation if bypassed.

Affected products are the TuriTop Booking System plugin from the vendor TuriTop, specifically any release up to and including version 1.0.10. The plugin is commonly deployed in WordPress sites as a booking system solution.

The CVSS score of 8.8 marks this as a high‑severity vulnerability, but the EPSS score of less than 1 % suggests low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this flaw by crafting a malicious payload that triggers the PHP deserialization routine, possibly via a crafted form submission or crafted URL. Because the flaw arises from deserialization of untrusted data, any input that is passed to PHP’s serializer without validation could be abused. Appropriate verification of the data source or deletion of the capability would effectively mitigate the risk.