Booking Activities WordPress plugin: PHP Object Injection
Summary
The Booking Activities WordPress plugin up to and including version 1.18.7.1 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). A remote attacker without an account or user interaction can submit crafted serialized data, which may let them manipulate how the site processes data and run harmful actions on the server. The impact depends on the PHP classes available on the site and on other installed plugins. The CVSS score is 9.8 (critical), and Patchstack expects exploitation.
Affected
- Booking Activities plugin for WordPress, versions up to and including 1.18.7.1
Fixed in
- Fixed version not confirmed. Version 1.18.8 is a candidate according to WPScan and the WordPress.org changelog, but no source explicitly links it to CVE-2026-97248. Verify with the Patchstack advisory.
Workaround
- No vendor workaround confirmed.
- Deactivate the plugin on sites where bookings are not critical.
- Restrict access to booking endpoints at the web server or WAF.
- Check whether serialized data is stored in the plugin's tables.
Exploitation
- CVSS 9.8, no authentication and no user interaction required.
- CISA SSVC: automatable yes, technical impact total, exploitation none recorded.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found; absence of evidence only.
- Patchstack describes the issue as expected to be exploited in mass campaigns.
- A similar earlier issue (CVE-2026-28176) affects versions up to 1.18.4.
Our recommendation
- Check whether any WordPress site runs Booking Activities 1.18.7.1 or earlier.
- Update to the latest available version, at least 1.18.8, and confirm the fixed version in the Patchstack advisory.
- If an update is not possible immediately, deactivate the plugin or restrict access to its booking endpoints.
- Review web server logs for unusual POST requests to booking endpoints.
- Monitor for further updates and advisories for this plugin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-97248 patchstack.com
- WordPress.org plugin listing and changelog wordpress.org
- WPScan Booking Activities wpscan.com
- Strix CVE-2026-97248 www.strix.ai
- OffSeq Radar CVE-2026-97248 radar.offseq.com
- Patchstack Booking Activities vulnerabilities patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:53.
Original description (NVD)
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.