Description

WordPress Plugin Sagenda-Free booking system is prone to a vulnerability that lets remote attackers inject and execute arbitrary code because the application fails to sanitize user-supplied input before being passed to the unserialize() PHP function. Attackers can possibly exploit this issue to delete files that the current user has access to. WordPress Plugin Sagenda-Free booking system version 1.3.2 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.3.3 or latest

References

https://github.com/advisories/GHSA-w2fr-65vp-mxw3

https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized

https://plugins.svn.wordpress.org/sagenda/trunk/readme.txt

Related Vulnerabilities

PHP Other Vulnerability (CVE-2005-3353)

Zope Web Application Server Other Vulnerability (CVE-2001-1278)

Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2025-43795)

WordPress Plugin Easy SVG Support Cross-Site Scripting (3.2.0)

WordPress Plugin InPost Gallery Multiple Vulnerabilities (2.1.2)

Severity

High

Classification

CVE-2019-10912 CWE-502 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update