WordPress Booking and Rental Manager plugin has a Deserialization of Untrusted Data vulnerability. The plugin accepts serialized PHP data from user-controllable sources and passes it to PHP’s unserialize function, enabling an attacker to inject malicious objects. If successful, the injected objects can trigger arbitrary code execution within the WordPress environment, compromising server integrity and confidentiality. The flaw is a classic PHP Object Injection, classified under CWE‑502.

The flaw affects the magepeopleteam Booking and Rental Manager plugin for WordPress, any installation of the plugin from the start of its releases through version 2.5.9. All WordPress sites that have this plugin installed and are running a vulnerable version are potentially exposed.

The CVSS score of 8.8 reflects high severity, and the EPSS score below 1 % indicates a low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted serialized payload to a plugin endpoint that processes such data, which is likely achievable via remote HTTP requests or manipulated cookies, making the attack vector remote. Once injected, the object can invoke PHP magic methods and execute arbitrary commands.