CVE-2026-12378

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar Plugin and Scheduling Plugin versions prior to 1.1.29

Description The plugin fails to validate data before passing it to a PHP deserialization function. This allows unauthenticated attackers to inject arbitrary PHP objects. If a suitable gadget chain (a sequence of existing code fragments that can be executed during deserialization) is present on the site, this can be leveraged to achieve remote code execution.

Recommendations Update the plugin to version 1.1.29 or later.