Eduadmin Booking
Monthly
Authentication bypass in the EduAdmin Booking WordPress plugin (all versions up to and including 5.4.2) lets an unauthenticated remote visitor reach functionality that should require a logged-in, privileged user. Patchstack rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assigned weakness is CWE-288 (Authentication Bypass Using an Alternate Path or Channel); our assessment concurs on the unauthenticated, no-interaction, remotely reachable nature of the flaw but scores availability as not impacted (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), so the practical consequence is high-impact disclosure and data manipulation rather than denial of service. No entry appears in CISA KEV and no public exploit code was identified at time of analysis, so exposure is currently driven by whether the plugin is installed and network-reachable rather than by active exploitation.
Authentication bypass in the EduAdmin Booking WordPress plugin (all versions up to and including 5.4.2) lets an unauthenticated remote visitor reach functionality that should require a logged-in, privileged user. Patchstack rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assigned weakness is CWE-288 (Authentication Bypass Using an Alternate Path or Channel); our assessment concurs on the unauthenticated, no-interaction, remotely reachable nature of the flaw but scores availability as not impacted (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), so the practical consequence is high-impact disclosure and data manipulation rather than denial of service. No entry appears in CISA KEV and no public exploit code was identified at time of analysis, so exposure is currently driven by whether the plugin is installed and network-reachable rather than by active exploitation.