EUVD-2026-41302
GHSA-wjq5-2fc7-77v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber account
-
DeliverySend crafted request to Booked action
-
ExploitMissing authorization check bypassed
-
ExecutionAccess or alter restricted booking data
-
ImpactExfiltrate confidential appointment information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated WordPress account at Subscriber level or higher on a site running the Booked plugin version 3.0.0 or earlier (PR:L in the CVSS vector confirms authenticated, not pre-auth, access). No user interaction is needed and the vector is network-based against the plugin's logged-in actions. The practical limiting factor is obtaining that account: sites that disable public registration force the attacker to already possess or phish credentials, whereas sites permitting open self-registration effectively lower the barrier to near-zero. The 'Authentication Bypass' tag notwithstanding, the vector shows a privilege/authorization gap for existing low-privilege users rather than a full authentication bypass. |
| Impact | The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N): network-reachable, low complexity, no user interaction, but requiring a low-privileged account, with high confidentiality and low integrity impact and no availability effect. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so real-world exploitation pressure appears low-to-moderate and cannot be quantified here. The main risk gate is that an attacker needs a valid low-privilege account, which is trivial on sites allowing open registration but a meaningful barrier on closed sites - making this a solid-but-not-emergency priority: patch on a normal cycle, prioritize sooner if user self-registration is enabled. The 'Authentication Bypass' tag is somewhat imprecise given PR:L in the vector indicates authenticated access rather than a full pre-auth bypass; treat this as a broken-access-control/privilege issue and verify scope against the Patchstack advisory. |
| Exploit ScenarioDerived | An attacker registers (or already holds) a Subscriber-level account on a WordPress site running Booked <= 3.0.0, then sends a crafted authenticated request to a Booked plugin action that lacks a capability check. Because no authorization is enforced, the request returns or manipulates data the Subscriber should not access, chiefly disclosing confidential booking/appointment information (C:H) with some limited write impact (I:L). No public POC is referenced, and the low attack complexity means the request can be replayed easily once the vulnerable endpoint is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Broken access control in the Booked WordPress appointment-scheduling plugin (versions <= 3.0.0, by ThemeRex) lets low-privileged authenticated users (Subscriber role) reach functionality or data they should not, resulting in high confidentiality exposure and limited integrity impact per the CVSS vector. The flaw stems from missing authorization checks (CWE-862) on plugin actions, so any registered site user can abuse it. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the issue was reported through Patchstack.
RemediationAI
No vendor-released patch version is identified in the available data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/booked/vulnerability/wordpress-booked-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve) and update to any version above 3.0.0 once published. As compensating controls until a fix is confirmed: disable open user self-registration (Settings > General > 'Anyone can register') to remove the trivial path to a Subscriber account, which prevents casual attackers but blocks legitimate new sign-ups; consider deactivating the Booked plugin on sites where booking is non-critical, at the cost of losing appointment functionality; and place a virtual-patch / WAF rule (Patchstack or equivalent) in front of the vulnerable plugin actions, accepting that rule tuning may affect legitimate Booked AJAX calls. Restrict and audit existing low-privilege accounts to limit who can invoke the affected endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Booked is a commercial WordPress plugin (vendor ThemeRex, CPE cpe:2.3:a:themerex:booked) that adds calendar-based appointment and reservation management to WordPress sites, exposing AJAX/REST-style actions to logged-in users. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints perform a sensitive operation without verifying that the caller holds the required capability, relying only on the fact that the user is authenticated. Because WordPress Subscriber is the lowest self-registerable role on many sites, any account can invoke the under-protected action, which is why the CVSS privileges-required metric is Low rather than High.
Know when Booked gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-reachable plugin action with a low-privilege (Subscriber) account and no interaction gives AV:N/AC:L/PR:L/UI:N; missing authorization exposes sensitive data (C:H) with limited writes (I:L) and no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in Booked <= 3.0.0 versions.
Executive ViewAI
The Booked WordPress appointment-scheduling plugin (versions ≤3.0.0) contains an access control flaw allowing any registered website user to access appointment schedules and customer information they should not see. This exposes client names, contact details, meeting times, and booking records to unauthorized staff or external parties, creating privacy and data protection compliance risks. Organizations using affected versions require immediate protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Booked plugin access to Administrator/Editor roles; remove or downgrade unnecessary Subscriber-level accounts; (2) Disable public user registration or implement email domain restrictions; (3) Disable public booking forms if not operationally required; (4) Enable WordPress audit logging to detect unauthorized appointment data access; (5) Conduct urgent access review of current Subscriber-role users with plugin visibility; (6) Document all customer data potentially exposed and assess regulatory notification requirements under GDPR/CCPA; (7) Evaluate and prepare for migration to alternative appointment-scheduling solutions with verifiable access controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitra
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId
Unauthenticated CSRF in Booked WordPress plugin (versions <= 3.0.0) enables remote attackers to trigger availability-imp
Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for
Exploit-DB