Executive brief
A vulnerability exists in the BookingPress appointment scheduling plugin for WordPress, which is used to manage customer bookings and calendars. An attacker can exploit this flaw to gain full control over the website without needing a username or password. This could lead to the theft of customer data, website defacement, or a complete shutdown of the booking service.
Technical details
The BookingPress plugin (also known as Appointment Booking Calendar Plugin and Scheduling Plugin) fails to validate user-supplied data before passing it to a PHP deserialization function. This vulnerability allows an unauthenticated remote attacker to inject arbitrary PHP objects into the application scope. If a suitable 'gadget chain' (a sequence of executable code within the site's existing plugins or themes) is present, the attacker can achieve remote code execution (RCE). The flaw is present in versions up to and including 1.1.28, and as of the advisory date, no official patch has been confirmed in the provided text, though WPScan indicates the issue is known.
Affected products
- BookingPress BookingPress - Appointment Booking Calendar Plugin and Scheduling Plugin <= 1.1.28
Timeline
- 2026-06-17: disclosed: Publicly published on WPScan
- 2026-07-08: advisory: CVE published to NVD dataset