CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.
Explanation of Vulnerability in Simple Terms
The Booking and Rental Manager plugin for WordPress contains a deserialization vulnerability in versions up to 2.2.6. An authenticated attacker with low privileges can send a specially crafted request to deserialize untrusted data, leading to arbitrary code execution on the site. This allows complete compromise of the WordPress installation, including data theft and site takeover.
What an attacker can do
Run arbitrary PHP code on the site and fully compromise it.
Potential impact on your site
Any user with low-privilege access can take over the site, steal data, or inject malware.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
