What is the CVSS score of CVE-2026-27400?

CVE-2026-27400 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of BookPro WordPress Plugin are affected by CVE-2026-27400?

The OvaTheme BookPro WordPress plugin (versions ≤ 1.1.0) contains an unauthenticated arbitrary file deletion vulnerability allowing attackers to delete critical files remotely without authentication,…

How to fix or mitigate CVE-2026-27400?

24 hours: Immediately deactivate and remove OvaTheme BookPro plugin from all WordPress installations; if removal is not feasible, deploy WAF rules blocking path traversal patterns (../ sequences) targeting plugin and core WordPress directories. 7 days: Audit server logs for file deletion events; verify wp-config.php and other critical WordPress files remain intact; check whether installation setup.php is accessible or accessible. 30 days: Monitor Patchstack advisory and OvaTheme vendor channels for security patch release; upon availability, test in staging environment and deploy patched version across production.

BookPro WordPress Plugin CVE-2026-27400

EUVD-2026-37669 HIGH

Path Traversal (CWE-22)

2026-06-17 Patchstack

WordPress Path Traversal Wordpress Plugin Bookpro

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Unauthenticated network-reachable endpoint with no user interaction; arbitrary file deletion changes scope to WordPress core and yields high availability impact with no direct confidentiality or integrity primitive.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:25 vuln.today

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

AnalysisAI

Unauthenticated arbitrary file deletion in the OvaTheme BookPro WordPress plugin (versions ≤ 1.1.0) allows remote attackers to delete arbitrary files from the underlying server via a path traversal flaw (CWE-22). Deletion of critical files such as wp-config.php can force a WordPress site into the setup state, enabling site takeover, while the scope-changed CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/A:H) and Patchstack disclosure mark this as a high-priority issue despite no public exploit being identified at time of analysis.

Technical ContextAI

BookPro (CPE cpe:2.3:a:ovatheme:bookpro) is a commercial WordPress booking/appointment plugin from OvaTheme. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): a file path supplied via an HTTP request is consumed by a file deletion routine (typically unlink()) without normalization or restriction to an allowed directory, so attacker-controlled segments like '../' escape the intended scope. Because the affected endpoint is reachable without authentication, the plugin exposes a PHP-level file system primitive to anonymous web traffic, and the Scope:Changed metric reflects that the impact extends beyond the plugin's own security authority to the entire WordPress installation and host file system the web user can write to.

RemediationAI

Patch availability is not explicitly stated in the supplied data - no vendor-released patch identified at time of analysis beyond the Patchstack listing, which should be consulted directly at https://patchstack.com/database/wordpress/plugin/ovabookpro/vulnerability/wordpress-bookpro-plugin-1-1-0-arbitrary-file-deletion-vulnerability for fixed-version confirmation; upgrade to any BookPro release later than 1.1.0 once OvaTheme publishes one. Until a fixed version is installed, deactivate and remove the BookPro plugin entirely (this disables all booking functionality, so plan a maintenance window or substitute plugin), or alternatively use a WAF / virtual patch (Patchstack, Wordfence, or ModSecurity) to block requests to the vulnerable AJAX/REST endpoint and to reject any request parameter containing '../', '..\', or absolute paths - note that WAF rules are bypass-prone and are only a stopgap. Additionally restrict filesystem permissions so the web user cannot delete wp-config.php or core files, and take a verified backup before applying any change.