WP BASE Booking CVE-2026-73402

Exploitation requires the attacker to possess a valid WordPress subscriber account on the target site, meaning either open user registration is enabled or the attacker has obtained subscriber credentials through another means. The victim - typically an administrator - must subsequently navigate to and render the page that displays the attacker's injected input (UI:R). Sites where user registration is disabled or restricted to vetted accounts are not exposed to external exploitation through this vector. The scope change (S:C) means the direct impact falls on the victim's browser session rather than the server itself, enabling session hijacking and privilege escalation but not direct server-side code execution.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:R/S:C reflects a meaningful but bounded threat: network-reachable and low-complexity, but constrained by the need for subscriber-level credentials and victim interaction. No EPSS score was supplied and the vulnerability does not appear in CISA KEV, and no POC code has been identified, all of which reduce immediate threat urgency. The scope change (S:C) is the most consequential factor - a subscriber who successfully injects a payload executing in an administrator's browser could hijack the admin session, create rogue admin accounts, or install malicious plugins, effectively achieving full site compromise through a single low-privilege account. Practical exposure is strongly modulated by whether the site permits open subscriber registration; sites with closed registration face substantially lower risk from external actors.

An attacker registers a subscriber account on a target WordPress site with open registration and WP BASE Booking <= 6.3.2 installed, then submits a booking request or fills a profile field with a crafted JavaScript payload. When an administrator later reviews pending bookings or navigates to the page rendering that input, the script executes silently in the admin's browser - exfiltrating the session cookie to an attacker-controlled server or issuing authenticated WordPress API requests to create a new admin user. No public POC has been identified, but XSS exploitation at this privilege tier is well within the capability of intermediate-skill attackers.