The plugin fails to validate input before deserialization and improperly limits a privileged maintenance feature. A user with the custom booking‑management capability can supply malicious serialized data that PHP will instantiate as arbitrary objects. This allows the attacker to overwrite site options and retrieve stored integration secrets, illustrating a classic deserialization of untrusted data flaw.

The vulnerability impacts all installations of the Online Scheduling and Appointment Booking System WordPress plugin running versions 23.2 through 28.2, inclusive of any predecessors. Users operating the plugin before version 28.3 are affected.

The flaw is likely triggered through the diagnostics advanced options feature of the plugin, as indicated by the reference to a privileged maintenance capability in the description; this is inferred from the text, not explicitly stated. An attacker who can assign or already possesses the custom booking‑management capability may supply a crafted serialized payload that bypasses access controls, leading to configuration tampering. The EPSS score is <1% and the CVSS score is 4.7, indicating a moderate severity, yet the lack of input validation makes exploitation straightforward for an authenticated user and poses a significant risk.