WordPress Plugin Vulnerabilities

BookingPress <= 1.5.5 - Unauthenticated PHP Object Injection

Description

The plugin does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
bookingpress-appointment-booking
No known fix

References

CVE
CVE-2026-12378

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Sanjar Tulkinov
Submitter
Sanjar Tulkinov
Verified
Yes
WPVDB ID
eb3abb88-43c3-42a8-a8a8-2ad67d37e020

Timeline

Publicly Published
2026-06-17 (about 22 days ago)
Added
2026-06-17 (about 21 days ago)
Last Updated
2026-07-08 (about 10 hours ago)

Other

Published
Title
Published
2023-12-28
Title
YITH WooCommerce Product Add-Ons < 4.3.1 - Authenticated(Shop Manager+) PHP Object Injection
Published
2025-05-21
Title
Fish House <= 1.2.7 - Unauthenticated PHP Object Injection
Published
2018-03-02
Title
WP Job Manager < 1.29.3 - Unauthenticated Object Injection
Published
2024-10-24
Title
Namaste! LMS < 2.6.4 - Authenticated (Subscriber+) PHP Object Injection
Published
2025-02-23
Title
ProfileGrid < 5.9.4.4 - Authenticated (Subscriber+) PHP Object Injection