CVE-2026-39539

Name of the Vulnerable Software and Affected Versions Alloggio - Hotel Booking versions prior to 2.1.3

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update Alloggio - Hotel Booking to a version newer than 2.1.2.