WpBookingly EUVD-2026-31097

Exploitation requires an authenticated session with high-privilege (Administrator-level) WordPress credentials, per CVSS PR:H - this is the primary limiting factor. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and requires no user interaction (UI:N), meaning once credentials are obtained, exploitation is straightforward. The flaw is limited to deployments running WpBookingly plugin version 1.2.9 or earlier on WordPress installations. There is no confidentiality impact (C:N), so the attack is oriented toward data manipulation and service disruption rather than data theft. The 'Authentication Bypass' tag from Patchstack suggests the authorization bypass occurs within the plugin's own access control layer, not at the WordPress authentication level - the precise endpoint or feature requiring the bypass condition has not been publicly detailed in available intelligence.

The CVSS base score of 6.5 (Medium) reflects a constrained real-world risk profile. The PR:H requirement - high privileges, consistent with WordPress Administrator level - significantly narrows the exploitable population to already-trusted accounts, which is the primary limiting factor. Despite this, the I:H and A:H impact metrics indicate that exploitation can result in full integrity and availability compromise of the plugin's data (e.g., booking records, service configurations). The C:N confidentiality impact suggests data exposure is not the primary concern. No EPSS score was provided in the available data, and this CVE is not listed in the CISA KEV catalog, both signals consistent with a lower exploitation urgency. The 'Authentication Bypass' tag applied by Patchstack introduces a potential conflict with the PR:H CVSS vector: if exploitation truly requires only administrator-level credentials, the 'bypass' characterization may refer to circumventing intra-application authorization controls rather than bypassing WordPress authentication itself. This nuance should be verified against the Patchstack advisory. Overall, this is a real but lower-priority vulnerability - meaningful for multi-tenant WordPress environments (managed hosting, site agencies) where administrator accounts may be shared or partially untrusted.

An attacker who has obtained or compromised a high-privilege WordPress account (e.g., Administrator) on a site running WpBookingly 1.2.9 or earlier sends a crafted network request to an insufficiently authorized plugin endpoint. Because the plugin does not enforce proper authorization checks, the attacker can manipulate or destroy booking data - modifying service schedules, deleting reservations, or disrupting availability - beyond what their role should permit within the plugin's own access model. No public exploit code has been identified at time of analysis.