Booking Activities vulnerabilities

The Booking Activities plugin in versions up to and including 1.18.7.1 is vulnerable to unauthenticated PHP object injection. An attacker can exploit this flaw without logging in.

Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.

Booking Activities versions up to 1.16.48.1 have a vulnerability in access control that allows unauthorized access.