CVE-2026-12378
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress up to version 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects. If a suitable gadget chain is present on the site, this can lead to remote code execution.
Risk Assessment
The risk for the organization includes the possibility of a complete takeover of the WordPress site by an unauthenticated attacker, potentially leading to data theft, malware installation, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately update the plugin to the latest available version that fixes this vulnerability, or temporarily disable the plugin until a patch is applied.
Original NVD description (English source)
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.