The Booking and Rental Manager plugin performs deserialization of untrusted data without proper validation, creating a PHP Object Injection flaw (CWE-502). An attacker who can supply a crafted serialized payload may instantiate malicious objects, potentially leading to arbitrary code execution within the WordPress environment.

All WordPress sites using the Booking and Rental Manager plugin from its earliest release through version 2.5.4 are affected. Systems running any <= 2.5.4 variant of this plugin are vulnerable, as the flaw is present in every historic version listed.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but the potential impact remains severe. Attackers could exploit the plugin by crafting requests that trigger the unsafe deserialization routine, thus executing arbitrary code or commands via the plugin’s API or front‑end interfaces.