What is the CVSS score of CVE-2026-57367?

CVE-2026-57367 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP Booking System are affected by CVE-2026-57367?

WP Booking System plugin (versions before 5.12.8.1) contains an access control flaw allowing any Subscriber-level user to alter booking records and data, putting booking integrity at risk for…. A patch is available.

How to fix or mitigate CVE-2026-57367?

Within 24 hours, identify and inventory all WordPress deployments running WP Booking System and determine current plugin versions. Within 7 days, either remove the plugin from affected sites or restrict Subscriber account permissions through WordPress role configuration to block booking modifications. Within 30 days, upgrade to WP Booking System version 5.12.8.1 or later when vendor patch is released, and review self-registration settings to minimize future exposure.

WP Booking System CVE-2026-57367

EUVD-2026-48162 HIGH

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-cp6f-c9gr-hrhh

WordPress Authentication Bypass Wordpress Plugin Wp Booking System

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network-reachable action abusable by an authenticated Subscriber (PR:L, AC:L, UI:N) yielding high integrity and low availability impact on booking data, with no confidentiality exposure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 23, 2026 - 13:18 EUVD

Analysis Generated

Jul 23, 2026 - 12:17 vuln.today

CVE Published

Jul 23, 2026 - 11:17 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

AnalysisAI

Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.

Technical ContextAI

WP Booking System is a WordPress plugin that adds calendar-based reservation and booking functionality (availability calendars, booking forms, and back-end booking management) to WordPress sites. The root cause is CWE-862 (Missing Authorization): one or more plugin actions - typically AJAX handlers or admin-post endpoints - fail to verify that the calling user holds the capability required for the operation, checking only that a user is authenticated rather than that they are authorized. As a result the Subscriber role, the lowest standard WordPress role intended for read-only account holders, can invoke privileged booking-management functionality. The single CPE provided (cpe:2.3:a:wp_booking_system_.:wp_booking_system) confirms the affected product is the WP Booking System plugin itself; the Patchstack advisory references the premium (wp-booking-system-premium) distribution.

RemediationAI

Vendor-released patch: 5.12.8.1 - upgrade the WP Booking System plugin to version 5.12.8.1 or later, which is the primary and definitive fix, and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-booking-system-premium/vulnerability/wordpress-wp-booking-system-plugin-5-12-8-1-broken-access-control-vulnerability for details. If immediate patching is not possible, reduce exposure by disabling open user self-registration (Settings > General > uncheck 'Anyone can register') so attackers cannot obtain the Subscriber accounts the exploit requires - the trade-off is that legitimate self-service signups are blocked; audit and remove untrusted existing Subscriber accounts; and place the plugin's AJAX/admin endpoints behind a WAF virtual patch or restrict them via access controls where feasible. Because this is authenticated abuse by low-privilege users, tightening role assignment and monitoring booking-data changes for unauthorized modifications are practical compensating controls until the update is applied.