JetBooking CVE-2026-65466

Exploitation requires an authenticated WordPress user account with a low-privilege custom booking role (PR:L per CVSS vector). The specific vulnerable code path is within the custom role functionality of JetBooking - this feature must be present and accessible to the attacker's role. High attack complexity (AC:H) further implies that specific conditions beyond simple authentication must be met, potentially including a particular role configuration or parameter format. Exploitation is limited by: (1) the requirement for at least low-privilege authenticated access, excluding fully unauthenticated attackers; (2) high attack complexity, reducing suitability for automated mass exploitation; (3) the impact is bounded to network-reachable internal services from the WordPress host, not the WordPress application data itself. No exploitation is possible against WordPress sites where the attacker has no user account.

The CVSS 3.1 score of 4.9 (Medium) reflects a realistic rather than alarming risk profile. The attack vector is network (AV:N), but high attack complexity (AC:H) limits opportunistic mass exploitation - specific conditions related to the custom role feature configuration must be present. Exploitation requires authenticated access with low privileges (PR:L), narrowing the attacker pool to users who hold a booking-related role on the WordPress site. The scope change (S:C) with low C and I impacts suggests that while internal services may be probed or lightly manipulated, full data exfiltration or compromise is not implied. No EPSS data was provided, no KEV listing exists, and no POC has been identified, all of which reduce urgency. This is a genuine but bounded risk: sites with internal cloud metadata services, staging APIs, or private backend services co-located with the WordPress host face higher real-world exposure. The AC:H metric should be independently verified - if custom roles are enabled by default or widely used, the effective complexity may be lower in practice.

An attacker who has registered or obtained a low-privilege custom booking role on a vulnerable WordPress site crafts a request to the JetBooking custom role feature, supplying a URL pointing to an internal cloud metadata service (e.g., http://169.254.169.254/latest/meta-data/) or an internal API. The WordPress server fetches the target URL and may return its contents to the attacker, disclosing instance credentials or internal service data. No public exploit code is known, and the AC:H rating indicates that reproducing the attack likely requires specific knowledge of the custom role trigger.