WP Booking Calendar, CVE-2022-1463

CVE, Research URL: CVE-2022-1463
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Published on: May 11, 2022
Research Description: The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.
Affected versions: Min -, max 9.1.1.
Status: vulnerable