CVE-2026-97248
CriticalCVSS 9.8Summary
The Booking Activities plugin in versions up to and including 1.18.7.1 is vulnerable to unauthenticated PHP object injection. An attacker can exploit this flaw without logging in.
Risk Assessment
This could lead to remote code execution or other severe impacts, compromising system confidentiality and integrity.
Recommendation
Update the Booking Activities plugin to a version newer than 1.18.7.1 to remove the vulnerability.
Other vulnerabilities in Booking Activities
See all- CVE-2026-28176High
Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.
- CVE-2026-39525Medium
Booking Activities versions up to 1.16.48.1 have a vulnerability in access control that allows unauthorized access.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS