The vulnerability CVE-2025-26921 affects the magepeopleteam Booking and Rental Manager plugin for WooCommerce (versions up to 2.2.6). It is caused by deserialization of untrusted data, enabling object injection attacks. This can allow an attacker with at least low privileges and no user interaction to execute arbitrary code or cause denial of service, impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No patch or official fix information is currently available.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized disclosure of information, modification of data, and disruption of service. The high CVSS score indicates a critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for suspicious activity. Avoid using affected versions and plan to update once a vendor patch is available.