What is the CVSS score of CVE-2026-61962?

CVE-2026-61962 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WP BASE Booking are affected by CVE-2026-61962?

Organizations running WP BASE Booking plugin versions 6.3.0 and earlier face immediate risk of total website compromise and customer data theft from unauthenticated remote code execution.

How to fix or mitigate CVE-2026-61962?

Within 24 hours, conduct a complete audit of all WordPress installations to identify WP BASE Booking plugin deployments and versions; immediately deactivate and remove the plugin from all affected systems, and review server logs for suspicious activity or injection attempts. Within 7 days, perform a comprehensive security scan of compromised systems for backdoors, web shells, or data exfiltration; change all WordPress and database credentials; and evaluate alternative booking solutions. Within 30 days, monitor vendor advisories for security updates; when a patch is released, apply it to isolated test environments first, then production; or permanently migrate to an alternative booking plugin with verified security practices.

WP BASE Booking CVE-2026-61962

EUVD-2026-57969 CRITICAL

Code Injection (CWE-94)

2026-08-13 Patchstack

GHSA-pxqc-78wp-7fq7

Code Injection RCE Wp Base Booking

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote code injection is low-complexity with full CIA impact; I assess S:U since code runs within the WordPress process, whereas the vendor scored S:C for 10.0.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:48 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

AnalysisAI

Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify site running WP BASE Booking ≤6.3.0

Delivery

Send crafted request to booking endpoint

Exploit

Inject code into vulnerable handler

Execution

Execute arbitrary PHP as web server

Impact

Deploy web shell, exfiltrate data

Access

Identify site running WP BASE Booking ≤6.3.0

Delivery

Send crafted request to booking endpoint

Exploit

Inject code into vulnerable handler

Execution

Execute arbitrary PHP as web server

Impact

Deploy web shell, exfiltrate data

Vulnerability AssessmentAI

Exploitation	The affected component is WP BASE Booking at any version up to and including 6.3.0 installed and active on a WordPress site; the code-injection sink is reachable remotely over HTTP without authentication (PR:N) and without user interaction (UI:N), so the primary prerequisite is simply that the vulnerable plugin be present and network-accessible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals available point to a genuine high priority rather than an inflated score: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, and the vendor's scope-changed rating produces the maximal 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker discovers a WordPress site running WP BASE Booking 6.3.0 or earlier and sends a crafted request to the plugin's booking handler containing an injected code payload, without needing any account or user interaction. The plugin evaluates the attacker-controlled input as code, executing it in the WordPress PHP context, after which the attacker plants a web shell and takes over the site. …
Remediation	Patch available per vendor advisory - upgrade WP BASE Booking to the first release above 6.3.0 as identified in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-3-0-arbitrary-code-execution-vulnerability); an exact fixed version is not confirmed in the available data, so verify the current fixed release directly on that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a complete audit of all WordPress installations to identify WP BASE Booking plugin deployments and versions; immediately deactivate and remove the plugin from all affected systems, and review server logs for suspicious activity or injection attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.