What is the CVSS score of EUVD-2026-57952?

EUVD-2026-57952 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Service Finder Booking EUVD-2026-57952

| CVE-2026-28159 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-xx5v-q5rj-f4pr

WordPress Authentication Bypass Wordpress Plugin Service Finder Booking

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint, low complexity; subscriber authentication required (PR:L); only availability impacted, consistent with unauthorized booking/service disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:19 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

AnalysisAI

Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.

Technical ContextAI

The affected product is the Service Finder Booking plugin for WordPress, developed by aonetheme (CPE: cpe:2.3:a:aonetheme:service_finder_booking:*:*:*:*:*:*:*:*), a commercial plugin designed for service marketplace and appointment booking functionality. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the requesting user's role or capability beyond basic authentication. In WordPress, the subscriber role is the lowest authenticated role and should have no administrative capabilities. The CVSS availability impact of High with no confidentiality or integrity impact suggests the exploitable action involves disrupting plugin functionality - such as canceling bookings, deleting listings, or corrupting service data - rather than exfiltrating or modifying records directly.

RemediationAI

The primary remediation is to update the Service Finder Booking plugin beyond version 6.2 once the vendor releases a patched build; check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sf-booking/vulnerability/wordpress-service-finder-booking-plugin-6-2-broken-access-control-vulnerability for a confirmed fix version, as no exact patch version was present in the available intelligence. If an update is not immediately available, disable open user registration to eliminate the subscriber attack surface (WordPress Admin > Settings > General > uncheck 'Anyone can register') - note this blocks legitimate new user signups. Alternatively, deploy a WAF rule (such as Patchstack's virtual patch, if available as a subscriber) to block unauthorized requests to the vulnerable endpoint. Site owners using managed WordPress hosts should verify whether their platform has applied automatic plugin updates or mitigation.