What is the CVSS score of CVE-2026-65468?

CVE-2026-65468 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

JetBooking CVE-2026-65468

Q: Which versions of JetBooking are affected by CVE-2026-65468?

Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data.

EUVD-2026-48080 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-fqvj-cq7c-v98r

WordPress Authentication Bypass Wordpress Plugin Jetbooking Crocoblock Jetimpex Inc

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication (AV:N, PR:N, AC:L); only booking data integrity is impacted - no confidentiality exposure or availability disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:25 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

AnalysisAI

Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.

Technical ContextAI

JetBooking is a WordPress booking management plugin developed by Crocoblock (JetImpex Inc.), identified via CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetbooking:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers execute privileged booking-related actions without first verifying the caller's identity or capability level. In WordPress, this pattern typically arises when a plugin registers action hooks (e.g., wp_ajax_nopriv_*) or REST API routes without a permission_callback, allowing any unauthenticated HTTP client to invoke functionality intended only for authorized users or administrators.

RemediationAI

Update JetBooking to the first version released after 4.1.2; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-1-2-broken-access-control-vulnerability) for the confirmed fix version, which was not independently verifiable from the provided data. If immediate patching is not possible, a compensating control is to place the WordPress admin AJAX endpoint (wp-admin/admin-ajax.php) and any relevant JetBooking REST routes behind IP allowlisting or a web application firewall rule that blocks unauthenticated POST requests to those paths - noting that this may break legitimate booking form submissions from end-users and requires careful scope tuning. Disabling the JetBooking plugin entirely until patched is the safest workaround for non-critical environments, with the trade-off of losing booking functionality.