Vulnerability · Published Jul 8, 2026 · Assigned by WPScan
CVE-2026-12378BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection
High 8.1
In plain English
A high-severity security flaw in Appointment Booking Calendar Plugin and Scheduling Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Appointment Booking Calendar Plugin and Scheduling Plugin | 0 – through 1.1.28 |
References
- https://wpscan.com/vulnerability/eb3abb88-43c3-42a8-a8a8-2ad67d37e020/ exploit, vdb-entry, technical-description