Description
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Booking Activities Team | Booking Activities | ≤ 1.18.7.1 | — |
Critical · 9.8
CVE-2026-97248
EUVD-2026-89912GHSA-72mh-3555-vj62
WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability
Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack