Broken access control in WordPress WP Booking System plugin (CVE-2026-57367)

The WP Booking System WordPress plugin contains a broken access control vulnerability exploitable by subscriber-level users. This flaw allows lower-privileged authenticated users to perform actions or access resources beyond their intended authorization. The vendor advisory page did not render substantive technical details beyond what is present in the NVD description. Affected versions: - < 5.12.8.1 We recommend updating to: 5.12.8.1. CVSS 7.1 · our assessment: this_week Reference: https://patchstack.com/database/wordpress/plugin/wp-booking-system-premium/vulnerability/wordpress-wp-booking-system-plugin-5-12-8-1-broken-access-control-vulnerability?_s_id=cve Details: https://vuln.today/cve/CVE-2026-57367