Deserialization of untrusted data in the magepeopleteam WpBookingly service-booking-manager plugin enables an attacker to perform PHP Object Injection. The vulnerability can allow execution of arbitrary PHP code, compromising confidentiality, integrity and availability of the WordPress site and any connected services. It is a critical weakness under CWE-502 and can lead to full system compromise if exploited.

WordPress sites running the WpBookingly plugin version 1.3.0 or earlier are affected. The issue impacts any installation that has not applied the newer plugin versions released after 1.3.0.

The CVSS score of 9.8 indicates high severity, while the EPSS score of less than 1% suggests very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit this by crafting requests to the service-booking-manager endpoint and sending deserialized data; the attack would require legitimate access to the plugin’s front-end or back-end and the ability to inject serialized data. Once exploited, arbitrary code execution can be achieved.