This vulnerability in magepeopleteam Booking and Rental Manager (versions <= 2.5.9) arises from unsafe deserialization of untrusted data, enabling object injection. Such flaws typically allow attackers to manipulate serialized data to execute arbitrary code or cause denial of service. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or fix is currently documented.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability, potentially allowing remote attackers with low privileges to execute arbitrary code or disrupt service. This can severely affect the security posture of websites using the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.