Booking Hub CVE-2026-32561

Exploitation requires an authenticated WordPress subscriber-level account (PR:L per CVSS vector). On sites where open user registration is enabled - common for booking platforms that require customer accounts - any unauthenticated internet user can self-register and immediately exploit this flaw, effectively collapsing the practical barrier. Sites that disable self-registration or restrict new accounts to invitation-only significantly limit exposure; an attacker without any account cannot directly exploit this vulnerability. No special plugin configuration, non-default setting, or specific platform version beyond Booking Hub ≤ 1.3.0 being installed and activated is required.

The CVSS 8.8 score with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects genuine high risk for sites with open user self-registration - a common configuration on booking sites where customers must create accounts. The PR:L requirement (low-privilege authenticated user) is the only meaningful barrier, and on sites allowing self-registration this reduces the effective barrier to near-zero for any internet user. No EPSS data was provided in the intelligence sources; KEV status is negative, and no POC has been identified at time of analysis. The S:U (unchanged scope) indicates impact is confined to the WordPress installation itself rather than the broader hosting environment, slightly tempering the blast radius. Overall, this is a genuine priority for affected sites, not a high-CVSS-but-low-real-risk issue, given the ease of obtaining a subscriber account.

An attacker visits a WordPress site running Booking Hub ≤ 1.3.0, self-registers a free subscriber account via the standard registration page, and then sends crafted HTTP requests targeting the plugin's improperly guarded endpoint. The capability check is absent or bypassable due to CWE-266, allowing the subscriber to perform administrative actions such as creating new administrator accounts, modifying site content, or installing malicious plugins. No public exploit code has been identified at time of analysis, but the low complexity (AC:L) makes independent exploit development straightforward.