A high-severity PHP object injection vulnerability in the Booking Activities plugin for WordPress could allow unauthenticated attackers to execute arbitrary code on the server.

This is a deserialization of untrusted data vulnerability, classified as CWE-502. The vulnerability allows an unauthenticated attacker to inject malicious PHP objects, which, when processed by the application, can lead to remote code execution or other unauthorized system impacts.

With a CVSS score of 8.8, this vulnerability represents a severe risk to any WordPress site utilizing the affected plugin. Successful exploitation could lead to full site compromise, unauthorized data access, and the potential for the server to be used as a pivot point for further network attacks. The ability for an unauthenticated attacker to exploit this increases the risk significantly.

Immediate Action: Update the WordPress Booking Activities plugin to version 1.18.5 or higher immediately.

Proactive Monitoring: Review web server logs for suspicious POST requests or unusual patterns that might indicate attempts to inject serialized data into the plugin.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious input and inspect for signs of object injection attempts before they reach the plugin.

Public Exploit Available: false

Given the potential for complete system compromise, administrators must update the Booking Activities plugin to the latest version immediately. If an update cannot be performed at this time, consider deactivating the plugin until a secure version is deployed.