Surbma Booking Com Shortcode CVE-2026-1607

This vulnerability presents moderate real-world risk despite the 6.4 CVSS score. The attack vector is network-based with low complexity (CVSS:3.1/AV:N/AC:L), but critically requires PR:L (authenticated user with contributor-level access or higher), which narrows the threat actor pool to trusted site users or compromised accounts. The scope change (S:C) means the vulnerability affects resources beyond the vulnerable component, increasing impact. However, the actual exploitation probability is constrained by the authentication gate: an attacker must either be a legitimate contributor, editor, or administrator, or successfully compromise such an account first. The impact is moderate-confidentiality and integrity are affected (C:L/I:L) but availability is not (A:N)-making this a data theft and site defacement vector rather than a critical compromise. For multi-user or multi-author WordPress sites with looser contributor access controls, this risk is elevated; for tightly controlled admin-only sites, risk is significantly lower. No KEV status or active exploitation has been reported, reducing urgency but not eliminating the need for patching vulnerable deployments.

A WordPress site with multiple contributors hosts the vulnerable plugin. An attacker compromises a contributor account or gains trusted contributor access through social engineering. The attacker creates a page or post using the surbma-bookingcom shortcode, injecting malicious JavaScript into a shortcode attribute (e.g., a label, title, or class parameter). When any site visitor (including admins and customers) views that page, the stored malicious script executes in their browser, potentially stealing session cookies, redirecting them to phishing pages, or defacing the site.