CVE-2026-12378

8.1 Élevée

Publiée le 08/07/2026 à 09:16 · Modifiée le 08/07/2026 à 16:56 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

Traduire en français

Produits concernés

Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Références

https://wpscan.com/vulnerability/eb3abb88-43c3-42a8-a8a8-2ad67d37e020/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories