Executive brief
The Entrepreneur theme for WordPress, which provides booking and scheduling functionality for small businesses, contains a security flaw that could allow registered users to execute unauthorized commands. By exploiting this vulnerability, an attacker with a basic 'Subscriber' account could potentially gain full control over the website, access sensitive customer data, or disrupt business operations. As of the latest report, there is no official fix from the developer, making it critical for site owners to use third-party security mitigations.
Technical details
A PHP Object Injection vulnerability exists in Themovation's Entrepreneur - Booking for Small Businesses WordPress Theme (versions <= 3.1.3) due to the insecure deserialization of user-supplied data (CWE-502). An attacker with Subscriber-level privileges can provide specially crafted input that, when processed by the theme, allows for the injection of PHP objects. If a suitable Property-Oriented Programming (POP) chain is present on the system, this can lead to remote code execution, SQL injection, or arbitrary file access. No official patch has been released by the vendor, though third-party virtual patching is available via security providers.
Affected products
- Themovation Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3
Timeline
- 2025-10-19: other: Vulnerability reported by researcher 0xd4rk5id3
- 2026-05-26: advisory: Initial advisory published by Patchstack
- 2026-06-17: disclosed: CVE published to NVD