What is the CVSS score of CVE-2026-56059?

CVE-2026-56059 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Travel Booking are affected by CVE-2026-56059?

The Travel Booking WordPress theme (versions 2.2.5 and earlier) contains a critical vulnerability enabling subscriber-level users to upload malicious files and execute arbitrary code on affected…

How to fix or mitigate CVE-2026-56059?

24 hours: Identify WordPress installations using Travel Booking theme versions ≤2.2.5; disable the theme or implement server-side upload filtering to block executable file types. Audit user accounts with Subscriber role. 7 days: Deploy Web Application Firewall rules to block .php and executable file uploads; monitor vendor advisory channels for patch release. 30 days: Apply vendor-released patch once available; conduct forensic review of application logs and wp-content/uploads for evidence of exploitation.

Travel Booking CVE-2026-56059

EUVD-2026-39713 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-26 audit@patchstack.com

GHSA-w944-78mf-7qrv

WordPress File Upload Wordpress Theme

9.9

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable upload exploitable by a low-privileged Subscriber (PR:L) with no user interaction; arbitrary PHP execution escapes the app to the host, justifying S:C and full C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:59 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

AnalysisAI

Arbitrary file upload in the Travel Booking WordPress theme (versions <= 2.2.5) lets an authenticated low-privileged Subscriber upload files of dangerous types, enabling web shell deployment and remote code execution. The CVSS 3.1 base score is 9.9 with a scope change (S:C), reflecting that a minimally-privileged account can fully compromise the underlying host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Travel Booking is a commercial WordPress theme providing travel/hotel booking functionality on WordPress sites. The flaw is a classic CWE-434 'Unrestricted Upload of File with Dangerous Type': an upload handler exposed to the Subscriber role fails to validate file extension, MIME type, or content, allowing executable PHP to be written into a web-accessible path. Because WordPress executes PHP from the uploads directory by default unless explicitly blocked, an uploaded script becomes directly reachable and runs in the web server's context. The CPE is not enumerated in the provided data; affected scope is identified only as the Travel Booking theme at or below version 2.2.5.

RemediationAI

Upgrade the Travel Booking theme to a version newer than 2.2.5 once the vendor publishes a fixed release; no exact patched version is confirmed in the available data, so verify the current version against the Patchstack advisory at https://patchstack.com/database/wordpress/theme/travel-booking/vulnerability/wordpress-travel-booking-theme-2-2-5-arbitrary-file-upload-vulnerability. As compensating controls until patched: disable open user self-registration (Settings > General > 'Anyone can register' unchecked) to remove the Subscriber attack surface, accepting that legitimate self-service signup is lost; deny PHP execution under wp-content/uploads via a web-server rule (an Apache .htaccess or nginx location block returning 403 for .php requests), which neutralizes uploaded shells but may break plugins that legitimately execute generated PHP from that path; and apply a WAF or virtual-patch rule on the theme's upload endpoint to reject non-whitelisted file types.