Webba Booking EUVD-2026-89897

Requires an authenticated WordPress account at Subscriber level or higher on a site running Webba Booking (webba-booking-lite) version 6.5.0 or earlier; the attacker manipulates a direct object reference to reach booking records belonging to other users. Limiting factors: exploitation is not possible unauthenticated (PR:L), impact is confined to limited confidentiality/information disclosure (C:L, no I/A), and no user interaction is needed (UI:N). Real-world risk depends on whether the target site permits open user registration, which is common for booking-oriented sites.

This is a genuinely low-priority, low-real-risk issue despite being a valid vulnerability. The CVSS 3.1 score of 4.3 (Medium) is driven by network vector (AV:N) and low attack complexity (AC:L), but exploitation requires an authenticated account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability impact (I:N/A:N). No EPSS score, KEV listing, or public exploit code is present in the provided data, so this is 'no public exploit identified at time of analysis.' The IDOR (CWE-639) allows a low-privileged Subscriber to reference objects belonging to other users, but the scope is unchanged (S:U) and the payoff is disclosure of limited booking-related data rather than account takeover or code execution. All signals are internally consistent - there is no conflict between the CVSS vector and the description. The one metadata caveat: the 'Authentication Bypass' tag is a loose fit, since CWE-639 is an authorization/access-control (IDOR) flaw against an already-authenticated user, not a true authentication bypass.

An attacker registers or obtains a low-privileged Subscriber account on a WordPress site running Webba Booking <= 6.5.0, then manipulates a direct object identifier (such as a booking or appointment ID) in a request to access another user's booking records they should not be able to view. No public proof-of-concept was identified, and the impact is limited to reading other users' limited booking data (C:L), not modifying it.