CVE-2026-28176

The vulnerability allows unauthenticated PHP Object Injection in Booking Activities versions up to 1.18.4, potentially enabling attackers to execute arbitrary code or manipulate application behavior. Organizations using affected versions should prioritize patching this issue due to its high severity and the risk of exploitation. Immediate action is recommended for those managing web applications that rely on this software to mitigate potential security breaches.