EUVD-2026-37666Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable plugin endpoint with no auth or user interaction (AV:N/PR:N/UI:N); AC:H reflects required victim enumeration or sequencing; full account takeover yields C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.
AnalysisAI
Account takeover in Booknetic WordPress appointment booking plugin versions 4.8.5 and earlier allows remote unauthenticated attackers to bypass authentication controls and gain access to arbitrary user accounts. The Patchstack advisory characterizes this as a broken authentication weakness (CWE-288) with high impact across confidentiality, integrity, and availability. No public exploit is identified at time of analysis, and exploitation requires high attack complexity per the CVSS vector.
Technical ContextAI
Booknetic (cpe:2.3:a:fs-code:booknetic) is a commercial WordPress plugin from FS-Code providing appointment scheduling, customer management, and booking workflows for service businesses. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the plugin exposes an authentication-sensitive code path that does not properly validate identity - typically via a parameter, endpoint, or workflow that lets a request impersonate or authenticate as another user without presenting valid credentials. The Patchstack vulnerability database categorizes this specifically as an account takeover issue, implying the broken authentication path resolves to taking over an existing account rather than merely escalating an authenticated session.
RemediationAI
Upstream fix available per Patchstack advisory; a specific released patched version is not independently confirmed in the provided data, so administrators should consult https://patchstack.com/database/wordpress/plugin/booknetic/vulnerability/wordpress-booknetic-plugin-4-8-5-account-takeover-vulnerability and the FS-Code Booknetic changelog for the exact post-4.8.5 release that contains the fix, then upgrade through the WordPress plugin updater. As compensating controls until patched, restrict access to the Booknetic frontend booking and customer-account endpoints via a WAF or .htaccess IP allowlist (trade-off: blocks legitimate public booking traffic), enable Patchstack or a comparable virtual-patching WAF that ships a signature for this CVE (trade-off: requires paid subscription), and force-rotate passwords plus invalidate all active sessions for any Booknetic-managed customer accounts (trade-off: customer friction). Temporarily deactivating the plugin is the most decisive mitigation if downtime of the booking feature is acceptable.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today