CVE-2026-28176
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.
Risk Assessment
The risk includes remote code execution or unauthorized system access, potentially leading to full compromise.
Recommendation
Immediately update the Booking Activities plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Booking Activities
See all- CVE-2026-97248Critical
The Booking Activities plugin in versions up to and including 1.18.7.1 is vulnerable to unauthenticated PHP object injection. An attacker can exploit this flaw without logging in.
- CVE-2026-39525Medium
Booking Activities versions up to 1.16.48.1 have a vulnerability in access control that allows unauthorized access.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS