What is the CVSS score of CVE-2026-57746?

CVE-2026-57746 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Booked are affected by CVE-2026-57746?

The Booked WordPress appointment-scheduling plugin (versions ≤3.0.0) contains an access control flaw allowing any registered website user to access appointment schedules and customer information they…

How to fix or mitigate CVE-2026-57746?

Within 24 hours: Inventory all WordPress installations running Booked plugin and verify current version numbers. Within 7 days: Restrict Booked functionality to Administrator and Editor roles only via WordPress role-based access controls; disable public user registration if business processes allow; monitor Patchstack and ThemeRex channels daily for patch announcements. Within 30 days: Apply vendor-released patch immediately upon availability, or migrate to an alternative scheduling platform if no patch is released by ThemeRex.

Booked CVE-2026-57746

EUVD-2026-41302 HIGH

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-wjq5-2fc7-77v9

WordPress Authentication Bypass Wordpress Plugin Booked Themerex

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable plugin action with a low-privilege (Subscriber) account and no interaction gives AV:N/AC:L/PR:L/UI:N; missing authorization exposes sensitive data (C:H) with limited writes (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:25 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Booked <= 3.0.0 versions.

AnalysisAI

Broken access control in the Booked WordPress appointment-scheduling plugin (versions <= 3.0.0, by ThemeRex) lets low-privileged authenticated users (Subscriber role) reach functionality or data they should not, resulting in high confidentiality exposure and limited integrity impact per the CVSS vector. The flaw stems from missing authorization checks (CWE-862) on plugin actions, so any registered site user can abuse it. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the issue was reported through Patchstack.

Technical ContextAI

Booked is a commercial WordPress plugin (vendor ThemeRex, CPE cpe:2.3:a:themerex:booked) that adds calendar-based appointment and reservation management to WordPress sites, exposing AJAX/REST-style actions to logged-in users. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints perform a sensitive operation without verifying that the caller holds the required capability, relying only on the fact that the user is authenticated. Because WordPress Subscriber is the lowest self-registerable role on many sites, any account can invoke the under-protected action, which is why the CVSS privileges-required metric is Low rather than High.

RemediationAI

No vendor-released patch version is identified in the available data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/booked/vulnerability/wordpress-booked-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve) and update to any version above 3.0.0 once published. As compensating controls until a fix is confirmed: disable open user self-registration (Settings > General > 'Anyone can register') to remove the trivial path to a Subscriber account, which prevents casual attackers but blocks legitimate new sign-ups; consider deactivating the Booked plugin on sites where booking is non-critical, at the cost of losing appointment functionality; and place a virtual-patch / WAF rule (Patchstack or equivalent) in front of the vulnerable plugin actions, accepting that rule tuning may affect legitimate Booked AJAX calls. Restrict and audit existing low-privilege accounts to limit who can invoke the affected endpoints.