CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.
Explanation of Vulnerability in Simple Terms
The Booking and Rental Manager plugin for WordPress contains a deserialization vulnerability in versions up to 2.5.4. An authenticated attacker with low privileges can send a specially crafted request to deserialize untrusted data, leading to remote code execution. This allows the attacker to run arbitrary PHP code on the site with full control over data and functionality.
What an attacker can do
Run their own PHP code on the site and access or modify any data.
Potential impact on your site
Any authenticated user can compromise the entire site, steal data, modify content, or inject malware.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
