CVE-2026-86841

4.7 Moyenne

Publiée le 27/09/2026 à 08:17 · Modifiée le 28/09/2026 à 18:38 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.

Traduire en français

Produits concernés

Unknown Online Scheduling and Appointment Booking System

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.7 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-502

Références

https://wpscan.com/vulnerability/2150717e-7564-4b29-b2e7-362dd3b480c3/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories