The vulnerability is a PHP Object Injection flaw in the WordPress Booking and Rental Manager plugin versions up to 2.7.5. An attacker can supply specially crafted serialized data to the plugin’s input handling, causing PHP to instantiate objects that may execute arbitrary code. The flaw is formally classified as CWE-502 and can lead to compromise of confidentiality, integrity, and availability of the affected WordPress site.

The affected product is the Booking and Rental Manager plugin developed by magepeopleteam. All installations running plugin version 2.7.5 or earlier are vulnerable. No additional affected systems are listed.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the nature of PHP Object Injection, exploitation requires the ability to defer serialized input to the plugin—likely achievable via user‑controlled form data or URL parameters. If the application processes this input during an authenticated session, the attacker may successfully inject and execute malicious objects, resulting in full code execution on the server.