WordPress Booking Plugin PHP Deserialization Remote Code Execution

The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress contains a critical PHP object injection vulnerability in versions through 1.1.28. The plugin fails to validate user-supplied data before passing it to PHP's deserialization functions, enabling unauthenticated attackers to inject malicious serialized objects. When a suitable gadget chain exists in the WordPress environment, this vulnerability can be exploited to achieve remote code execution (RCE) with the privileges of the web server. This poses an immediate threat to any WordPress installation using this plugin, as the attack requires no authentication and can be triggered remotely.

Casky's security skills leverage Claude AI with extended reasoning to detect the attack patterns associated with this deserialization vulnerability by analyzing code paths related to MITRE ATT&CK T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Practitioners using Casky would observe findings highlighting unsafe deserialization patterns, particularly PHP unserialize() calls without input validation, suspicious object instantiation sequences characteristic of gadget chain exploitation, and POST/GET parameter handling that directly reaches serialization functions. The platform would flag the absence of input sanitization checks, type validation, or use of safe alternatives like json_decode(), helping teams identify vulnerable plugin versions in their codebase before exploitation occurs.