CVE-2026-12378 is a deserialization of untrusted data vulnerability (CWE-502) in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress, affecting all versions up to and including 1.1.28. The plugin fails to validate input before passing it to a PHP deserialization function, enabling unauthenticated attackers to inject arbitrary PHP objects. Exploitation requires the presence of a suitable gadget chain on the target site, which can lead to remote code execution. No official patch or remediation level has been published at this time.

Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely on the affected WordPress site, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability, as reflected by the high CVSS score (8.1). No known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor and apply patches promptly once available.