BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection (CVE-2026-12378) | HOL Guard CVE