Skip to content
Sign in
8.1 High

CVE-2026-12378 The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data…

Description

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

Affected products and versions

Product Affected versions Fixed in
Appointment Booking Calendar Plugin and Scheduling Plugin 1.1 earliest → 1.1.28 No fix stated

Other CVEs of Appointment Booking Calendar Plugin and Scheduling Plugin

The 3 CVEs of Appointment Booking Calendar Plugin and Scheduling Plugin →
CVE-2026-76586 The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the… 7.5 High CVE-2024-12274 The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings… 7.5 High
Track this CVE