Deserialization Vulnerability in Online Scheduling and Appointment Booking System by WordPress
CVE-2026-86841

Currently unrated

Key Information:

Vendor

WordPress
Status
Online Scheduling And Appointment Booking System
Vendor
CVE Published:
27 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86841?

The Online Scheduling and Appointment Booking System for WordPress is susceptible to a deserialization issue which can be exploited to inject arbitrary PHP objects. This vulnerability arises from the failure to restrict a privileged maintenance feature, allowing users with a custom booking-management capability (assigned by an administrator) to manipulate site options and access sensitive integration secrets. Proper restrictions and input validation must be implemented to mitigate this risk.

Affected Version(s)

Online Scheduling and Appointment Booking System 23.2 < 28.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86841 - Proof of Concept

References

https://wpscan.com/vulnerability/2150717e-7564-4b29-b2e7-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.