WP BASE Booking CVE-2026-59541

Exploitation requires the attacker to hold a valid authenticated WordPress account at the Subscriber (low-privilege) level, consistent with the CVSS PR:L metric - it is NOT unauthenticated. The practical enabling condition is a site configured to allow user self-registration (WordPress 'Anyone can register' enabled) or any other means of obtaining a Subscriber account, which makes the account prerequisite trivial to satisfy on many public sites. What limits exploitation: sites that disable self-registration and tightly control account creation force the attacker to first obtain credentials by other means; no special non-default plugin configuration is stated as required, and no user interaction is needed (UI:N). The exact vulnerable feature or endpoint within WP BASE Booking is not detailed in the available data.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation that requires only a low-privileged authenticated account and no user interaction, with high impact across confidentiality, integrity, and availability. The single required precondition - a Subscriber account - is a low barrier on any WordPress site permitting self-registration, which materially raises real-world risk. Countervailing signals: the vulnerability is NOT in CISA KEV (no confirmed active exploitation), and no public proof-of-concept has been identified, so this is currently a high-severity but not confirmed-exploited issue. EPSS data was not provided in the input and therefore cannot be cited. The reporting source is Patchstack, a reputable WordPress vulnerability database, which lends confidence to the CVSS assessment even though independent NVD enrichment is absent from the supplied data.

An attacker registers or acquires a Subscriber-level account on a WordPress site running WP BASE Booking <= 6.3.1, then sends a crafted authenticated request to a vulnerable plugin endpoint that improperly assigns elevated privileges (CWE-266), granting administrative capabilities. From there the attacker can modify bookings, exfiltrate customer data, alter site content, or install malicious code. No public proof-of-concept has been identified at time of analysis, and exploitation requires only a low-privileged account with no victim interaction (AC:L/UI:N).