EUVD-2026-114094
GHSA-4wj5-97hx-xw88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
ExploitCall plugin endpoint lacking authorization check
-
ImpactRead or modify restricted booking data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a running instance of the Webba Booking (webba-booking-lite) WordPress plugin at version 6.5.4 or earlier, and a valid authenticated account on the site - the CVSS PR:L and the Missing Authorization (CWE-862) classification indicate a logged-in low-privilege user (such as a subscriber) can reach a function that omits a proper capability/authorization check. Limiting factors: exploitation is not available to fully unauthenticated attackers (authentication is required per PR:L), no user interaction is needed (UI:N), and impact is confined to low confidentiality and low integrity with no availability effect. The exact feature, endpoint, or configuration that exposes the missing check is not described in the available sources. |
| Impact | This is a moderate-severity broken access control issue (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than a top-tier emergency. The network vector and low attack complexity make the flaw easy to reach, but PR:L means a valid authenticated account is required, which meaningfully narrows the attacker population and caps blast radius to low confidentiality and low integrity impact with no availability effect. No EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit code is identified at time of analysis, so there is no signal of active or widespread exploitation. The only intelligence signal of urgency is the vuln.today priority label of 'this_month' and the Patchstack reporting, which is consistent with a credible but non-critical, patch-on-a-normal-cycle issue. Signals are internally consistent here - no conflict between the CVSS vector and the description - so this reads as a real but routine priority, not a high-CVSS-but-low-real-risk mislabel nor an urgent one. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged account (for example a registered subscriber) on a WordPress site running Webba Booking Lite 6.5.4 or earlier sends a request to a plugin function that fails to verify the caller's authorization. Because the missing authorization check is reachable over the network with low complexity, they can read or alter booking-related data they should not have access to. No public exploit code is identified at time of analysis; the precise function and trigger are not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Missing authorization in the Webba Booking WordPress plugin (webba-booking-lite) through version 6.5.4 lets a logged-in low-privilege user, such as a subscriber, reach a function that omits a proper capability check. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) scores this at 5.4, reflecting low confidentiality and integrity impact with no availability effect, and no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor reference points to the Patchstack advisory for the 6.5.4 broken access control issue.
RemediationAI
Update the Webba Booking plugin beyond the affected 6.5.4 range as soon as a patched release is available, and verify the fixed version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-5-4-broken-access-control-vulnerability-2; no exact fix version was identified in the available data, so confirm the release number with the vendor before upgrading. Because exploitation requires a low-privilege authenticated account (PR:L), reducing exposure means limiting who can register and hold accounts on the site - for example disabling open self-registration and reviewing existing subscriber-level users - with the trade-off of restricting legitimate community sign-ups. Where the plugin's booking features are not needed site-wide, disabling the affected plugin removes the attack surface entirely at the cost of losing booking functionality. Monitor the advisory for the patched version and re-test any custom capability or role configuration after updating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (Missing Authorization) in the Webba Booking plugin for WordPress, CPE cpe:2.3:a:webba_plugins:webba_booking, affecting versions through 6.5.4. The root cause class is an access control omission: a function or action reachable over the network does not verify that the calling user holds the required capability, so the security level intended by the plugin configuration is not enforced. Per the assessed vector, the attacker must hold a valid authenticated account (PR:L) - a fully unauthenticated attacker is not positioned to exploit it - while no user interaction is needed (UI:N) and scope is unchanged (S:U). The specific feature, endpoint, AJAX action, or configuration that exposes the missing check is not described in the available sources, and the trigger is therefore not confirmed beyond the authorization-omission classification.
Know when Webba Booking gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Missing authorization reachable over the network with low complexity but requiring a low-privilege authenticated account (PR:L), yielding limited read/write (C:L/I:L) and no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webba Booking
View allUnauthenticated remote attackers can bypass access controls in the Webba Booking WordPress plugin (all versions through
Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin - Webba Book
Missing authorization (CWE-862) in the Webba Booking WordPress plugin (webba-booking-lite) affects all versions through
Authenticated users with Subscriber-level access or higher can exploit an insecure direct object reference in Webba Book
The Appointment & Event Booking Calendar Plugin - Webba Booking plugin for WordPress is vulnerable to unauthorized modif
Exploit-DB