CVE-2026-12378
Last modified
CVE-2026-12378 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Appointment Booking Calendar Plugin and Scheduling Plugin | <= 1.1.28 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-12378?
How severe is CVE-2026-12378?
How do I fix CVE-2026-12378?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
- CVE-2026-123765Improper neutralization of input during web page generation …
- CVE-2026-123766Improper Neutralization of Input During Web Page Generation …
- CVE-2026-123770Allocation of Resources Without Limits or Throttling vulnera…7.5
- CVE-2026-123776RRD::CGI::Image versions through 0.01 for Perl pass CGI quer…9.8
- CVE-2026-123779Direct Request ('Forced Browsing') vulnerability in Apache A…5.3
- CVE-2026-123782ChatWiki before 2.10.0 contains an insecure direct object re…4.3
- CVE-2026-123783Skyvern through 1.0.56 contains a sandbox bypass vulnerabili…8.8
- CVE-2026-123784Fluxbox through 1.3.7 contains an OS command injection vulne…7.8
- CVE-2026-123785Fluxbox through 1.3.7 contains an infinite loop vulnerabilit…5.5
- CVE-2026-123786Agenta before 0.122.5 contains a server-side request forgery…8.5
- CVE-2026-123787A weakness has been identified in nexmoe VidBee up to 1.3.13…4.3
Are you affected by CVE-2026-12378?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST