CVE-2026-97248

The vulnerability allows unauthenticated PHP Object Injection in Booking Activities versions up to 1.18.7.1, potentially enabling attackers to execute arbitrary code or manipulate application behavior. Organizations using these versions should prioritize immediate remediation efforts to mitigate the risk of exploitation, given the critical severity rating. This is particularly urgent for businesses relying on Booking Activities for managing reservations or bookings, as the impact could lead to significant data breaches or service disruptions.