CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.9.
Explanation of Vulnerability in Simple Terms
Booking and Rental Manager versions up to 2.5.9 contain a deserialization vulnerability that allows authenticated users to execute arbitrary code on the site. An attacker with low-level access can craft malicious serialized data to trigger code execution with full site privileges. This affects confidentiality, integrity, and availability of the entire installation.
What an attacker can do
Run their own code on the site with full administrative privileges.
Potential impact on your site
Complete compromise of the site: data theft, malware injection, site defacement, or total takeover.
Conditions required to exploit
Attacker must have a low-level user account (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
