Apr 27

WordPress Security PHP Object Injection Vulnerability in Booking Calendar Plugin

"On April 18, 2022, Object Injection vulnerability in the Booking Calendar plugin for WordPress, which has over 60,000 installations."

Wordfence "
Description: Insecure Deserialization/PHP Object Injection
Affected Plugin: Booking Calendar
Plugin Slug: booking
Plugin Developer: wpdevelop, oplugins
Affected Versions: <= 9.1
CVE ID: CVE-2022-1463
CVSS Score: 8.1(High)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Researcher/s: Ramuel Gall
Fully Patched Version: 9.1.1
"

Ref: Wordfence