What is the CVSS score of CVE-2026-59541?

CVE-2026-59541 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WP BASE Booking are affected by CVE-2026-59541?

The WP BASE Booking plugin (versions 6.3.1 and earlier) contains a privilege escalation vulnerability allowing any registered user to gain administrative control over the booking system and…

How to fix or mitigate CVE-2026-59541?

Within 24 hours: Audit all WP BASE Booking installations for versions 6.3.1 and earlier; disable open user registration or implement mandatory admin approval for new accounts to reduce attacker registration vectors. Within 7 days: Restrict Subscriber role permissions to exclude administrative booking operations through WordPress role management; audit all user accounts and revoke unexpected administrative privileges; consider isolating the affected WordPress instance from critical backend systems. Within 30 days: Monitor vendor advisories and plugin repositories for patch releases; immediately apply the patched version when available; conduct a comprehensive access review and revoke administrative privileges from any accounts created during the vulnerability exposure period.

WP BASE Booking CVE-2026-59541

EUVD-2026-48194 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-23 Patchstack

GHSA-mgq4-mxf3-c87g

Privilege Escalation Wp Base Booking

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable authenticated action needing only a low-privileged Subscriber account (PR:L), no interaction, low complexity, yielding full admin-level control hence high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:46 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 8.8

DescriptionCVE.org

Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.

AnalysisAI

Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenticated Subscriber elevate their permissions to a higher-privileged role. Because the CVSS vector is AV:N/PR:L with high confidentiality, integrity, and availability impact, an attacker holding any low-level account - trivially obtained on sites with open registration - can gain administrative-level control over the booking system and potentially the wider WordPress instance. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is WP BASE Booking (marketed as 'WP BASE booking of appointments, services and events'), a WordPress appointment/booking plugin by developer Hakan Ozevin (CPE cpe:2.3:a:hakan_ozevin:wp_base_booking). The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin grants a user more privileges than their assigned role should carry - typically caused by a plugin action, AJAX handler, or capability check that fails to properly validate the caller's role before performing privileged operations such as role/capability modification or accessing administrative functionality. In WordPress, Subscriber is the lowest built-in role and normally cannot manage content, users, or settings, so a defect that lets a Subscriber assume elevated capabilities effectively collapses the site's role-based access model.

RemediationAI

Upgrade WP BASE Booking to a version newer than 6.3.1 once the vendor publishes a fix; the supplied data does not name a confirmed patched release, so at time of analysis no vendor-released patched version is independently confirmed - check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-3-1-privilege-escalation-vulnerability) and the plugin's WordPress.org page for the fixed version. Because exploitation requires a low-privileged account, an effective compensating control is to disable open user self-registration (uncheck 'Anyone can register' in WordPress Settings > General) or restrict the default new-user role, which removes the easy path to obtaining the Subscriber foothold at the cost of blocking legitimate self-service signups. Additionally, deploy a WordPress virtual-patching WAF (Patchstack or equivalent) to block the privilege-escalation request pattern, audit existing user accounts for unexpected role elevation, and consider deactivating the plugin until a patched version is available if the booking functionality is non-essential.