EUVD-2026-48080
GHSA-fqvj-cq7c-v98r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site running JetBooking
-
DeliveryIdentify unprotected AJAX or REST endpoint
-
ExploitSend unauthenticated HTTP POST with crafted booking payload
-
ExecutionBypass missing authorization check
-
ImpactPerform unauthorized booking modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates no special conditions - remote unauthenticated exploitation is possible against any default installation of JetBooking ≤ 4.1.2 on WordPress with network-accessible wp-admin/admin-ajax.php or REST API endpoints (both enabled by default in WordPress). The limiting factor is impact scope: only integrity is affected (I:L), meaning attackers can manipulate booking records but cannot read confidential data or crash the service. Exploitation is further bounded to sites that have the JetBooking plugin installed and activated; sites not using this plugin are unaffected. |
| Impact | CVSS 5.3 (Medium) reflects a network-accessible, no-authentication, low-complexity attack with a limited integrity-only impact (C:N/I:L/A:N) and no scope change. No EPSS data was provided in the input; without it, exploitation probability cannot be quantitatively assessed. Neither CISA KEV listing nor public proof-of-concept code was reported, which reduces immediate urgency compared to other unauth broken-access-control issues. The real-world risk is meaningful for internet-facing WordPress sites - unauthenticated manipulation of booking records could disrupt operations, corrupt availability schedules, or be used to harass a business - but the absence of confidentiality impact and no availability impact limit the blast radius. The Patchstack report is the sole intelligence source; no independent vendor advisory or NVD enrichment was present in the provided data. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running JetBooking ≤ 4.1.2 (e.g., via WPScan or HTTP header fingerprinting) and sends a crafted HTTP POST request directly to the vulnerable endpoint - likely a nopriv AJAX handler or unauthenticated REST route - triggering a booking action (such as creating, modifying, or canceling a reservation) that should require authentication. No public proof-of-concept code has been reported, but the low attack complexity (AC:L) means the technique is straightforward for any attacker familiar with WordPress plugin auditing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
RemediationAI
Update JetBooking to the first version released after 4.1.2; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-1-2-broken-access-control-vulnerability) for the confirmed fix version, which was not independently verifiable from the provided data. If immediate patching is not possible, a compensating control is to place the WordPress admin AJAX endpoint (wp-admin/admin-ajax.php) and any relevant JetBooking REST routes behind IP allowlisting or a web application firewall rule that blocks unauthenticated POST requests to those paths - noting that this may break legitimate booking form submissions from end-users and requires careful scope tuning. Disabling the JetBooking plugin entirely until patched is the safest workaround for non-critical environments, with the trade-off of losing booking functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBooking is a WordPress booking management plugin developed by Crocoblock (JetImpex Inc.), identified via CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetbooking:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers execute privileged booking-related actions without first verifying the caller's identity or capability level. In WordPress, this pattern typically arises when a plugin registers action hooks (e.g., wp_ajax_nopriv_*) or REST API routes without a permission_callback, allowing any unauthenticated HTTP client to invoke functionality intended only for authorized users or administrators.
Know when Jetbooking gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no authentication (AV:N, PR:N, AC:L); only booking data integrity is impacted - no confidentiality exposure or availability disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB