Unauthenticated PHP Object Injection in Booking Activities

Executive Summary

This is an unauthenticated PHP Object Injection vulnerability in the Booking Activities WordPress plugin versions 1.18.4 and below. It allows attackers to inject malicious PHP objects that could lead to code execution, SQL injection, or other attacks if a suitable POP chain exists.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if the Booking Activities plugin version 1.18.4 or below is installed. Inspect WordPress installations for the plugin and verify the version. No specific commands are provided in the context, but monitoring for unusual activity or unauthorized changes may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to execute arbitrary code, manipulate databases, access sensitive files, or cause denial of service. Successful exploitation requires a privileged user to trigger the vulnerability, such as clicking a malicious link or submitting a form.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, data breaches, or denial of service, which may violate GDPR (data protection) and HIPAA (health data security) requirements for safeguarding sensitive information. Unpatched systems risk non-compliance due to potential exposure of personal or health-related data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Booking Activities plugin to version 1.18.5 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is completed.

Useful 0 Not Useful 0