CyberRota Analysis
AI-GeneratedThe Appointment Booking Calendar and Scheduling plugins for WordPress versions up to 1.1.28 are vulnerable due to improper data validation before PHP deserialization, enabling unauthenticated attackers to inject arbitrary PHP objects. This flaw can lead to remote code execution if a suitable gadget chain exists on the site. WordPress administrators and users of these plugins should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.