Webba Booking Lite EUVD-2026-102047

Exploitation requires reaching the Webba Booking Lite plugin's booking endpoint on a WordPress site running version 6.5.2 or earlier and supplying a user-controlled key/object identifier that the plugin fails to authorize against the requester. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is claimed, implying default-configuration exploitability; however, because the flaw is described as 'Incorrectly Configured Access Control Security Levels,' realistic impact may depend on how booking visibility/roles are configured, and WordPress IDORs of this class often in practice require at least a low-privileged authenticated session - this should be confirmed with the Patchstack advisory. Limiting factors: impact is confined to confidentiality (C:H, I:N, A:N) - i.e., unauthorized data disclosure, not modification or denial of service - and only sites with the vulnerable plugin installed and active are affected.

This is a CVSS 7.5 (High) IDOR / broken-access-control flaw (CWE-639) in the Webba Booking Lite WordPress plugin. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity issue with no privileges or user interaction required, yielding high confidentiality impact but no integrity or availability impact - consistent with unauthorized disclosure of other users' booking data via a user-controlled object reference. There is no EPSS score supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore moderate and non-urgent: a real-but-not-critical issue typical of Patchstack-reported WordPress plugin IDORs, where the dominant risk is data leakage rather than code execution. One tension to verify: IDOR/access-control bypasses in WordPress plugins frequently require an authenticated low-privileged session in practice, yet the vector claims PR:N (unauthenticated) - the description's phrase 'Incorrectly Configured Access Control Security Levels' does not independently confirm the privilege level, so the unauthenticated claim should be confirmed against the Patchstack advisory before treating it as fact.

A remote attacker manipulates a user-controlled identifier (e.g., a booking or object ID) in a request to the Webba Booking endpoint, causing the plugin to return booking records belonging to other users without a proper authorization check. Because the CVSS vector indicates low attack complexity and no user interaction, the request can be iterated/enumerated to harvest booking data at scale. No public exploit code is referenced, but the flaw class (IDOR) is trivial to weaponize manually.