What is the CVSS score of CVE-2026-24371?

CVE-2026-24371 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2026-24371?

A critical authorization vulnerability in BA Book Everything allows unauthenticated attackers to bypass access controls with a 9.8 CVSS score.

How to fix or mitigate CVE-2026-24371?

Within 24 hours: Inventory all systems running BA Book Everything and assess exposure; implement network segmentation to restrict access to booking modules. Within 7 days: Deploy WAF rules to detect/block exploitation attempts; disable non-essential booking features if feasible; enable enhanced logging and monitoring. Within 30 days: Contact vendor for patch timeline; evaluate alternative booking solutions; conduct security assessment of affected systems for signs of compromise.

Wordpress Plugin CVE-2026-24371

MEDIUM

Missing Authorization (CWE-862)

2026-01-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 4.3 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.

AnalysisAI

BA Book Everything WordPress plugin has a missing authorization vulnerability allowing unauthenticated users to access and modify booking data.

Technical ContextAI

The BA Book Everything plugin by bookingalgorithms has a CWE-862 missing authorization vulnerability that allows unauthenticated access to booking management endpoints.