WP BASE Booking EUVD-2026-36968

Target must be a WordPress site running the WP BASE Booking of Appointments, Services and Events plugin at version 5.9.0 or earlier with the plugin activated and its front-end/AJAX/REST endpoints reachable by the attacker. No WordPress authentication is required (PR:N), and no user interaction is required (UI:N), so the attacker only needs network reachability to the WordPress site. Exploitation is limited by CVSS AC:H, indicating a non-trivial precondition such as a specific request sequence, timing, or knowledge of an identifier the attacker must obtain or guess; the exact gating condition is not enumerated in the public Patchstack summary provided.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated flaw with high impact across CIA, tempered by high attack complexity - indicating some non-trivial condition (specific request shape, race, or state) must be met. EPSS data was not provided in the input and the CVE is not listed on CISA KEV, so there is no confirmed widespread or targeted exploitation; no public exploit identified at time of analysis. The combination of unauthenticated access and full WordPress takeover potential means defenders should prioritize patching despite AC:H, particularly because WordPress plugin vulnerabilities are routinely automated once a working PoC is published on Patchstack or similar databases. Note: Patchstack lists this as a privilege escalation but does not specify the exact vulnerable endpoint in the public reference - technical details beyond the title are limited at time of analysis.

A remote attacker with no WordPress account sends a crafted HTTP request to a vulnerable WP BASE Booking endpoint on the target site, triggering the privilege-escalation flaw to either elevate an attacker-controlled account or perform an administrator-only action such as creating a new admin user or modifying site options. With administrative access the attacker installs a malicious plugin or theme to gain code execution and full site takeover. No public exploit identified at time of analysis, but Patchstack advisories of this class are routinely reproduced once details are published.