The Booking and Rental Manager for WooCommerce plugin contains a critical deserialization vulnerability that enables authenticated attackers to achieve remote code execution.

This flaw is caused by improper handling of serialized data (CWE-502), which allows an authenticated user to perform PHP object injection. The vulnerability is reachable over the network and requires the attacker to have at least low-level authenticated access to the application.

Successful exploitation of this vulnerability poses a severe risk to the integrity, availability, and confidentiality of the host environment. By injecting malicious objects, an attacker can potentially execute arbitrary code, leading to complete site compromise, data exfiltration, or total system failure. Given the CVSS score of 8.8, this flaw is categorized as High severity and requires immediate prioritization to prevent unauthorized administrative control over the e-commerce platform.

Immediate Action: Review the official Patchstack advisory and the vendor website for the release of a patched version; if no update is available, deactivate or remove the plugin until a fix is deployed.

Proactive Monitoring: Inspect server and application logs for unusual serialized PHP strings or unexpected execution behavior originating from authenticated user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection patterns or restrict access to the vulnerable plugin endpoints to authorized administrators only.

Public Exploit Available: Unknown.

The presence of an object injection vulnerability in an e-commerce plugin presents a significant security risk to customer data and platform stability. Administrators must treat this as a high-priority item, verify the status of the plugin vendor, and apply the necessary security updates as soon as they become available to prevent potential full-system compromise.