Booking Hub CVE-2026-81769

Requires an authenticated low-privileged WordPress account (PR:L) - typically a subscriber or booking-customer role - on a site running Booking Hub ≤1.3.1. Sites with open user registration are most exposed because attackers can self-register with no prior relationship to the site. Sites with closed registration (admin-only account creation) reduce real-world risk significantly, as the attacker must already possess or compromise a valid low-privilege credential. No special plugin configuration is specified in available data beyond having the plugin active. Exploitation is network-accessible (AV:N) with no user interaction required (UI:N).

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-severity, network-exploitable flaw requiring only a low-privilege account and no user interaction - but not entirely unauthenticated. The PR:L gate means sites with closed registration face meaningfully lower risk than those allowing public self-registration (a common configuration for booking plugins, where customers create accounts to manage reservations). Attack complexity is low, suggesting no chaining or special conditions beyond account possession. No KEV listing and no explicit POC reference in available data, reducing urgency relative to actively exploited issues. EPSS data is absent from provided intelligence. Real-world risk is highest for public-facing booking sites where visitor self-registration is enabled, as attackers can trivially acquire the required low-privilege foothold. For sites with closed or invite-only registration, the practical attack surface is substantially narrowed.

An attacker visits a public booking site, self-registers a customer account, then issues a crafted HTTP request to a plugin endpoint lacking proper capability checks, assigning their account the WordPress administrator role. With administrator access, they can install backdoored plugins, exfiltrate site data, or fully compromise the hosting environment. No public POC has been identified in available data, but the low attack complexity suggests the technique is straightforward once the vulnerable endpoint is identified.