High · 8.8 CVE-2026-28176 EUVD-2026-57959GHSA-mc9r-rc7r-x444

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Published Aug 13, 2026 · Updated Aug 13, 2026 · Assigned by Patchstack

Vendor: Booking Activities Team Product: Booking Activities

Description

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

Affected products

Vendor	Product	Affected	Fixed
Booking Activities Team	Booking Activities	≤ 1.18.4	—

References

https://patchstack.com/database/wordpress/plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-18-4-php-object-injection-vulnerability?_s_id=cve vdb-entry