WP BASE Booking EUVD-2026-114314

Requires an authenticated WordPress account at subscriber level on a site running WP BASE Booking <= 6.5.2 (PR:L); the attacker then triggers the incorrect privilege assignment to gain a higher role. The specific feature, endpoint, or parameter that triggers the escalation is not described in the available sources. Limiting factors: an attacker-controlled subscriber account is a prerequisite, so sites that disable open user registration raise the bar significantly; exposure is confined to installations of this specific plugin at or below version 6.5.2. No special non-default configuration beyond having the vulnerable plugin active is indicated by the available data.

This is a genuinely serious but conditionally-gated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) shows network reach, low complexity, no user interaction, and - critically - PR:L, meaning the attacker must already hold a low-privilege (subscriber) account. The 'Subscriber Privilege Escalation' title and CWE-266 (Incorrect Privilege Assignment) are consistent with that vector: a logged-in subscriber elevates to a higher-privileged role, yielding full confidentiality, integrity, and availability impact over the WordPress site. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit identified at time of analysis - only the Patchstack advisory reference. The vuln.today decision label is 'this_week', indicating a prompt-but-not-immediate priority, which aligns with the signal mix: high impact and low attack complexity, but gated behind needing a subscriber account and with no evidence of active exploitation. The main real-world amplifier is that many WordPress sites allow open self-registration at subscriber level, which can effectively lower the PR:L barrier; sites with registration disabled are substantially less exposed.

An attacker registers (or obtains) a subscriber-level account on a WordPress site running WP BASE Booking <= 6.5.2, then abuses the flawed privilege assignment to elevate their own role to a higher-privileged one such as administrator. With AC:L and no user interaction required, the escalation can be driven remotely by the authenticated attacker once the account exists. No public exploit code was identified in the provided sources, and the exact trigger is not described in the available sources.