This vulnerability in magepeopleteam Booking and Rental Manager (<= 2.5.4) allows an attacker with at least low privileges to exploit deserialization of untrusted data, leading to object injection. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or fix details are available from the vendor or advisory sources at this time.

Successful exploitation could lead to full compromise of the affected system's confidentiality, integrity, and availability due to object injection via deserialization of untrusted data. This could allow attackers to execute arbitrary code or manipulate application behavior. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity. Avoid processing untrusted input where possible. Do not rely on generic mitigations without vendor confirmation.