CVE-2026-28176 HIGH

CVE-2026-28176: WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Vendor Booking Activities Team
Product Booking Activities
Weakness CWE-502 · Unsafe deserialization
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Booking Activities versions up to 1.18.4 contain a deserialization vulnerability that allows attackers to execute arbitrary code on the site. An attacker can craft a malicious serialized object that, when deserialized by the application, executes code with full site privileges. The vulnerability requires user interaction—typically a site administrator must visit a malicious link or page—but once triggered, grants complete control over the WordPress installation.

What an attacker can do

03Attacker Capabilities

Execute arbitrary code on the site and take full control of the WordPress installation.

Potential impact on your site

04Site Impact

Complete compromise of the site, including data theft, malware injection, and loss of administrative control.

Conditions required to exploit

05Prerequisites

Network access and user interaction required; typically requires an admin or authenticated user to visit a malicious link.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability CVE-2026-39498 WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability CVE-2026-49765 WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability CVE-2026-57713 WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability CVE-2026-65573 WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability