Webba Booking EUVD-2026-41055

Exploitation requires the target WordPress installation to have the Webba Booking plugin installed and active at version 6.4.13 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, elevated privileges, or non-default configuration is required - any internet-facing WordPress site with the plugin active is reachable. The specific unprotected endpoint(s) and the exact booking actions accessible without authorization are not detailed in available intelligence beyond the Patchstack advisory. Exploitation is bounded by the CVSS integrity-only impact (I:L, S:U): attackers cannot exfiltrate data (C:N) or disrupt availability (A:N), limiting the attack to unauthorized write-level interactions with booking data within the vulnerable plugin's scope.

The CVSS 3.1 base score of 5.3 (Medium) reflects a genuinely limited impact profile: while the attack is fully unauthenticated and network-reachable with low complexity (AV:N/AC:L/PR:N/UI:N), the scope is unaffected (S:U) and impact is confined to partial integrity (I:L) with no confidentiality or availability consequence. For WordPress-hosted booking services - where appointment integrity is business-critical - unauthorized manipulation of reservations could have real operational impact disproportionate to the raw CVSS score. However, EPSS data is not present in available intelligence, the vulnerability is not listed in the CISA KEV catalog, and no public POC has been identified, all of which point away from active or widespread exploitation. This is a real but not urgent priority: sites using Webba Booking for customer-facing scheduling should patch promptly, while organizations not running this plugin face zero exposure.

An attacker with no account or prior access scans for WordPress sites running Webba Booking via passive reconnaissance (e.g., wappalyzer fingerprinting, plugin enumeration) and sends a crafted unauthenticated HTTP POST request to the vulnerable booking endpoint. The missing authorization check allows the request to proceed, enabling the attacker to manipulate booking records - for example, bulk-canceling appointments or injecting fraudulent reservations - without ever authenticating. No POC has been publicly released, but the AC:L/PR:N/UI:N vector indicates exploitation requires only knowledge of the endpoint and a basic HTTP client.