What is the CVSS score of EUVD-2026-41055?

EUVD-2026-41055 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Webba Booking EUVD-2026-41055

| CVE-2026-27409 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 Patchstack

GHSA-pgwq-hmm6-jcx5

WordPress Authentication Bypass Wordpress Plugin Webba Booking

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no complexity barrier; impact is integrity-only and scoped to the vulnerable plugin system, with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:56 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Webba Booking: from n/a through 6.4.13.

AnalysisAI

Unauthenticated remote attackers can bypass access controls in the Webba Booking WordPress plugin (all versions through 6.4.13) due to missing server-side authorization checks on one or more booking-related endpoints, enabling unauthorized integrity-affecting actions such as creating, modifying, or canceling bookings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation requiring no credentials or user interaction against any internet-facing WordPress site running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

Webba Booking is a WordPress appointment and reservation management plugin developed by Webba Plugins. The root cause is CWE-862 (Missing Authorization), a class of flaw where server-side handlers - commonly WordPress AJAX actions registered via admin-ajax.php or REST API routes - execute privileged operations without verifying the calling user's capabilities (e.g., no current_user_can() check or nonce validation tied to a privileged role). The CPE string cpe:2.3:a:webba_plugins:webba_booking:*:*:*:*:*:*:*:* confirms all versions through 6.4.13 are within scope. The Patchstack tag 'Authentication Bypass' further indicates that functionality intended for authenticated users or administrators is reachable without any credentials, consistent with the PR:N designation in the CVSS vector.

RemediationAI

Upgrade Webba Booking to a version above 6.4.13 once a patched release is published by the vendor. No specific fixed version number is confirmed in available intelligence - administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-4-13-broken-access-control-vulnerability?_s_id=cve and the official WordPress plugin repository changelog for a remediated release. As a compensating control prior to patching, consider deploying WAF rules that restrict unauthenticated POST requests to WordPress AJAX endpoints (wp-admin/admin-ajax.php) and any booking-related REST API routes; note this may disrupt legitimate front-end booking workflows for end users and should be tested before production deployment. If booking functionality is non-critical or can be temporarily suspended, deactivating the plugin entirely eliminates the attack surface with no residual risk.