External risk intelligence

Booktics Plugin PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-57621

This vulnerability affects a WordPress plugin, which is typically deployed as part of an internet-facing web application. Since web applications are commonly exposed to the public internet to facilitate user interaction and booking functionality, the attack surface is considered likely to be reachable from the internet in common deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in certain PHP-based applications that handle bookings. The issue, an unauthenticated PHP Object Injection, could potentially allow unauthorized access and manipulation of application data and functionality. Given the nature of booking systems, which often store sensitive customer and operational information, this type of vulnerability warrants attention to confirm if your organization utilizes affected systems.

Unauthenticated code injection in booking software.
External access risk to customer and operational data.
Confirm relevance and exposure of booking systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable Booktics installation over the network. This request targets the PHP Object Injection flaw, which can allow an unauthenticated attacker to remotely execute arbitrary code on the server.

No authentication required.
Unserializes untrusted data.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious PHP objects into the Booktics plugin. This could potentially lead to the execution of arbitrary code on the server, impacting the availability and integrity of the service.

Server-side code execution.
Via unauthenticated requests.
Service disruption or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in unauthenticated PHP Object Injection affects the Booktics plugin. Infrastructure or platform teams responsible for the web application hosting the plugin should prioritize identifying all instances of Booktics. Confirming reachability and business criticality will help accountable owners prioritize remediation, potentially involving coordination with the vendor or implementing temporary risk-reduction measures.

Identify Booktics plugin instances.
Verify exposure and criticality first.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Booktics plugin?

Booktics is a WordPress plugin designed to manage scheduling and appointment booking. It allows organizations to integrate booking functionality directly into their websites, enabling users to reserve time slots or services. Because it sits within the WordPress ecosystem, it processes user interactions and data handling tasks necessary for day-to-day operations.

What does PHP Object Injection mean for CVE-2026-57621?

This vulnerability is classified as CWE-502, which occurs when an application accepts untrusted data and uses it to reconstruct a PHP object without proper validation. In this case, it allows an attacker to inject malicious objects into the application, potentially leading to unauthorized remote code execution on the server hosting the plugin.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specially crafted, malicious request to the web server where the Booktics plugin is installed. Because this is an unauthenticated vulnerability, no login credentials or prior access to the site are required. It is important to note that simply visiting the site as a regular user does not trigger the bug; it requires a specific, intentionally malformed request designed to exploit the object injection flaw.

Is my instance of Booktics at risk?

Halo Surface Signal indicates that because Booktics is a plugin for web applications, it is commonly deployed in internet-facing environments. If your instance is accessible from the public internet to facilitate booking functionality, it is considered likely reachable by attackers. Internal systems that are not exposed to the internet face a lower probability of being targeted through this specific network-based attack vector.

What steps should I take if I use Booktics?

Start by identifying all instances of the Booktics plugin within your environment. Once identified, verify which sites are internet-facing and assess their business criticality. Since this is a critical vulnerability, coordinate with your technical teams to plan for necessary updates or to implement temporary risk-reduction measures while you confirm the status of your installations.

References

patchstack.com/database/wordpress/plugin/booktics/vulnerability/word…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.