The vulnerability identified as CVE-2025-32607 affects the magepeopleteam WpBookingly service-booking-manager plugin up to version 1.3.0. It involves deserialization of untrusted data, which can lead to object injection attacks. This type of vulnerability allows an attacker to craft malicious serialized objects that, when deserialized by the application, can execute arbitrary code or manipulate application logic. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code, manipulate data, or cause denial of service in the affected WpBookingly plugin. This compromises the confidentiality, integrity, and availability of the system running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is released, users should consider disabling or removing the vulnerable plugin to mitigate risk.