The plugin fails to validate input before deserialization and improperly limits a privileged maintenance feature. A user with the custom booking‑management capability can supply malicious serialized data that PHP will instantiate as arbitrary objects. This allows the attacker to overwrite site options, retrieve stored integration secrets, and potentially execute code, illustrating a classic deserialization of untrusted data flaw.

The vulnerability impacts all installations of the Online Scheduling and Appointment Booking System WordPress plugin running versions 23.2 through 28.2, inclusive of any predecessors. Users operating the plugin before version 28.3 are affected.

The flaw is likely triggered through the diagnostics advanced options feature of the plugin, as indicated by the reference to a privileged maintenance capability in the description; this is inferred from the text, not explicitly stated. An attacker who can assign or already possesses the custom booking‑management capability may supply a crafted serialized payload that bypasses access controls, leading to configuration tampering or code execution. Although EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the lack of input validation makes exploitation straightforward for an authenticated user and poses a high risk.