A critical PHP object injection vulnerability in the Booking and Rental Manager plugin allows authenticated contributors to achieve full system compromise.

This vulnerability is a deserialization of untrusted data (CWE-502). It permits an authenticated user with contributor-level access to inject malicious PHP objects, which can lead to remote code execution.

The exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it allows for unauthorized remote code execution on the host server. Given the CVSS score of 8.8, this flaw could result in complete data loss, unauthorized access to sensitive customer information, and potential lateral movement within the network. The ability for a contributor to escalate privileges to the server level makes this a high-priority threat to business continuity and data integrity.

Immediate Action: Update the Booking and Rental Manager for WooCommerce plugin to version 2.7.6 or later immediately.

Proactive Monitoring: Review web server logs for suspicious POST requests containing serialized PHP objects or anomalous behavior originating from contributor-level accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP deserialization patterns to provide temporary protection until the patch is applied.

Public Exploit Available: Unknown.

Organizations utilizing the Booking and Rental Manager plugin must prioritize this update to prevent potential remote code execution. Given the high severity of this flaw, security teams should audit all user accounts with contributor privileges to ensure no unauthorized access is being leveraged while the remediation process is completed.