What is the CVSS score of CVE-2026-40774?

CVE-2026-40774 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Booking Package are affected by CVE-2026-40774?

The SaaSProject Booking Package WordPress plugin (versions 1.7.06 and earlier) contains an unauthenticated broken access control vulnerability allowing remote attackers to modify booking records…

How to fix or mitigate CVE-2026-40774?

Within 24 hours: Identify all WordPress instances running SaaSProject Booking Package version 1.7.06 or earlier; classify by business criticality; contact SaaSProject for patch timeline. Within 7 days: Deploy Web Application Firewall (WAF) rules restricting unauthenticated requests to plugin API endpoints; implement network-level access controls; evaluate disabling the plugin if non-critical. Within 30 days: Apply vendor-released patch to all affected systems immediately upon availability; upgrade SaaSProject Booking Package to patched version; audit booking modification logs for unauthorized changes since disclosure date (2026).

Booking Package CVE-2026-40774

EUVD-2026-36983 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-8367-f83r-jqj5

WordPress Authentication Bypass Wordpress Plugin Booking Package Saasproject

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable WordPress endpoint (AV:N), no auth or interaction required per "unauthenticated" description (PR:N/UI:N), broken access control tampers with booking data (I:H) without exposing or destroying it (C:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:10 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

AnalysisAI

Unauthenticated broken access control in the SaaSProject Booking Package WordPress plugin versions 1.7.06 and earlier allows remote attackers to invoke privileged plugin functionality without authentication, resulting in unauthorized modification of booking data (CVSS 7.5, integrity-only impact). The flaw is a CWE-862 Missing Authorization issue disclosed via Patchstack and tracked in ENISA EUVD as EUVD-2026-36983, with no public exploit identified at time of analysis.

Technical ContextAI

Booking Package is a SaaSProject-developed WordPress plugin (CPE cpe:2.3:a:saasproject:booking_package) that exposes appointment and reservation management to site administrators through WordPress AJAX/REST endpoints. CWE-862 (Missing Authorization) indicates one or more of these endpoints fail to perform a capability check (current_user_can) or nonce verification before executing privileged operations, so requests from unauthenticated visitors are processed as if they were authorized. This pattern is common in WordPress plugins when admin-ajax actions are registered with the wp_ajax_nopriv_ prefix or REST routes omit a permission_callback.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should upgrade the Booking Package plugin to the latest version published after 1.7.06 from the WordPress.org plugin repository or the SaaSProject vendor site, consulting https://patchstack.com/database/wordpress/plugin/booking-package/vulnerability/wordpress-booking-package-plugin-1-7-06-broken-access-control-vulnerability for the exact fixed release. Until the upgrade is applied, compensating controls include disabling and deactivating the Booking Package plugin entirely (which removes booking functionality from the site), or placing the affected admin-ajax.php and /wp-json/ REST endpoints behind a WAF rule (Patchstack/Wordfence virtual patch) that blocks unauthenticated requests carrying the plugin's action parameters - at the cost of potentially blocking legitimate front-end booking flows that rely on the same endpoints. Restricting access to wp-admin/admin-ajax.php to authenticated sessions only is not viable here because WordPress requires nopriv endpoints for many front-end features, so a targeted WAF rule is preferable.