CVE-2025-26921 Overview
CVE-2025-26921 is a PHP Object Injection vulnerability in the magepeopleteam Booking and Rental Manager for WooCommerce plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 2.2.6. Authenticated attackers with low privileges can inject arbitrary PHP objects, potentially leading to remote code execution, data tampering, or denial of service when a suitable gadget chain is present in the application stack.
Critical Impact
Authenticated attackers can trigger object injection over the network, compromising confidentiality, integrity, and availability of affected WordPress sites running the Booking and Rental Manager plugin.
Affected Products
- magepeopleteam Booking and Rental Manager for WooCommerce plugin
- All versions from n/a through 2.2.6
- WordPress installations using booking-and-rental-manager-for-woocommerce
Discovery Timeline
- 2025-03-15 - CVE-2025-26921 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-26921
Vulnerability Analysis
The vulnerability is classified as Deserialization of Untrusted Data [CWE-502]. The Booking and Rental Manager plugin processes serialized PHP input from user-controlled sources without adequate validation. When PHP unserialize() operates on attacker-controlled data, it instantiates arbitrary objects and triggers their magic methods such as __wakeup() and __destruct().
An attacker who supplies a crafted serialized payload can chain existing classes in WordPress core, the plugin, or other installed plugins into a property-oriented programming (POP) chain. This chain can result in arbitrary file writes, SQL injection, or code execution depending on the gadgets available in the runtime.
The EPSS score is 0.425% with a percentile of 33.8, indicating moderate predicted exploitation activity. No public proof-of-concept has been published at the time of writing.
Root Cause
The plugin invokes unserialize() on data influenced by HTTP request parameters without enforcing an allowlist of expected classes. PHP's native deserialization mechanism does not restrict which classes can be instantiated, allowing attacker-controlled gadget chains to execute during object reconstruction.
Attack Vector
The attack vector is Network with low attack complexity. The attacker must hold authenticated access with low privileges, such as a subscriber or customer account. No user interaction is required. The attacker submits a crafted serialized object through a vulnerable plugin endpoint, and the server deserializes the payload, triggering the gadget chain.
No verified exploit code is publicly available. See the Patchstack WordPress Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-26921
Indicators of Compromise
- HTTP requests to plugin endpoints containing serialized PHP payloads beginning with O:, a:, or s: followed by length and class identifiers
- Unexpected PHP errors referencing __wakeup, __destruct, or unserialize in web server logs
- Creation of new administrator accounts or modifications to WordPress options tables shortly after suspicious POST requests
- Outbound network connections from the PHP worker process to unfamiliar hosts
Detection Strategies
- Inspect WordPress request logs for parameters containing serialized object signatures sent to booking-and-rental-manager-for-woocommerce endpoints
- Deploy a WordPress Web Application Firewall (WAF) rule that flags or blocks serialized PHP objects in request bodies and query strings
- Monitor wp_options, wp_users, and plugin tables for unauthorized changes correlated with plugin activity
Monitoring Recommendations
- Enable verbose PHP error logging and forward logs to a centralized SIEM for correlation
- Alert on PHP file modifications under wp-content/plugins/ and wp-content/uploads/ outside of scheduled maintenance windows
- Track authenticated low-privilege accounts performing requests to administrative or backend plugin handlers
How to Mitigate CVE-2025-26921
Immediate Actions Required
- Update the Booking and Rental Manager for WooCommerce plugin to a version newer than 2.2.6 once the vendor releases a fix
- Audit existing WordPress user accounts and remove unused low-privilege accounts that could be abused for authenticated exploitation
- Restrict access to the WordPress site's authenticated endpoints using IP allowlisting where feasible
Patch Information
At the time of publication, the vulnerability affects all versions through 2.2.6. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for a patched release. Apply the update immediately upon availability and verify the installed version after deployment.
Workarounds
- Deactivate and remove the Booking and Rental Manager plugin until a patched version is released if booking functionality is not business-critical
- Deploy a WAF policy that inspects request bodies and blocks PHP serialized object patterns targeting plugin routes
- Disable account self-registration on the WordPress site to limit the pool of low-privileged authenticated attackers
- Apply the principle of least privilege to all WordPress user roles and review plugin capabilities regularly
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
