Webba Booking EUVD-2026-112863

Exploitation requires an existing authenticated account on the target WordPress site at a low privilege level (CVSS PR:L), after which a plugin action missing an authorization check can be invoked over the network with no user interaction. The specific vulnerable feature, parameter, or configuration is not described in the available sources. Limiting factors: the attacker must first obtain valid (even low-level) credentials, impact is confined to integrity only (no data disclosure or denial of service), and the site must be running Webba Booking at or below version 6.5.4.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Webba Booking (webba-booking-lite) WordPress plugin, with a vendor CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The signals are mostly consistent and point to a real but bounded issue rather than an emergency. The vector indicates a network-reachable attack of low complexity that requires some existing privilege (PR:L) and no user interaction, with only a limited integrity impact and no confidentiality or availability impact - consistent with a low-privilege authenticated user performing an action that access controls should have blocked. No EPSS probability is provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. No proof-of-concept or exploit reference is present in the supplied data - the only reference is the Patchstack vulnerability-database advisory. The vuln.today decision label is 'this_month', which aligns with a patch-in-routine-cycle priority rather than act_now/emergency. Net assessment: a legitimate issue to remediate on a normal patch cadence, de-prioritized by its low impact and the authentication prerequisite, but not a high-urgency, widely-exploited threat based on the available signals.

An attacker who already holds a low-privilege authenticated account on a WordPress site running Webba Booking (through 6.5.4) sends a request to a plugin action that fails to enforce proper authorization, allowing them to alter booking-related data they should not be able to modify. The specific vulnerable endpoint and trigger are not described in the available sources. No public exploit or PoC code is identified in the provided data.