Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar Security & Risk Analysis

The "booking-manager" plugin v2.1.18 exhibits a mixed security posture. While the static analysis shows a relatively contained attack surface with no identified unprotected entry points and a reasonable percentage of SQL queries using prepared statements, concerns arise from the presence of the `unserialize` function. This function is a common vector for remote code execution if used with untrusted input, and its presence warrants careful review of its usage. The taint analysis, though limited in scope, did not reveal critical or high-severity unsanitized paths, which is a positive sign.

The plugin's vulnerability history is a significant concern. With a total of four known CVEs, including one high-severity vulnerability and three medium-severity ones, it indicates a past pattern of security weaknesses. The types of past vulnerabilities (XSS, Missing Authorization, SQL Injection, SSRF) are common and can have severe impacts if exploited. While there are currently no unpatched CVEs, the historical pattern suggests a higher likelihood of future vulnerabilities if development practices do not significantly improve. The most recent vulnerability being in late 2025 is also notable, implying a recent discovery or patching.

In conclusion, "booking-manager" v2.1.18 has strengths in its limited attack surface and some secure coding practices like prepared statements. However, the presence of `unserialize` and a history of multiple vulnerabilities, including high and medium severity, necessitate a cautious approach. The plugin developers need to ensure robust input sanitization and authorization checks are consistently applied across all features, especially around the usage of `unserialize`, and maintain a proactive security patching strategy.