Wp Base Booking
Monthly
Subscriber-level users of the WP BASE Booking WordPress plugin through version 6.5.2 can escalate their privileges because the plugin performs an incorrect privilege assignment (CWE-266), with successful exploitation giving high confidentiality and integrity impact. The attack requires an authenticated subscriber account but no user interaction and is network-reachable; sites that allow open registration make that prerequisite much easier to satisfy. Patchstack reported the issue, the vuln.today priority is this_week, and no public exploit was identified at time of analysis; this is serious but conditionally gated rather than an emergency.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenticated Subscriber elevate their permissions to a higher-privileged role. Because the CVSS vector is AV:N/PR:L with high confidentiality, integrity, and availability impact, an attacker holding any low-level account - trivially obtained on sites with open registration - can gain administrative-level control over the booking system and potentially the wider WordPress instance. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated privilege escalation in the WP BASE Booking WordPress plugin (versions through 5.9.0) allows remote attackers to elevate privileges without credentials, with potential to fully compromise affected WordPress sites. The flaw is rated CVSS 8.1 (high) with no public exploit identified at time of analysis, but the unauthenticated nature and high impact on confidentiality, integrity, and availability make it a notable risk for sites running the plugin.
Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. No public exploit code or active exploitation has been identified at time of analysis.
Subscriber-level users of the WP BASE Booking WordPress plugin through version 6.5.2 can escalate their privileges because the plugin performs an incorrect privilege assignment (CWE-266), with successful exploitation giving high confidentiality and integrity impact. The attack requires an authenticated subscriber account but no user interaction and is network-reachable; sites that allow open registration make that prerequisite much easier to satisfy. Patchstack reported the issue, the vuln.today priority is this_week, and no public exploit was identified at time of analysis; this is serious but conditionally gated rather than an emergency.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenticated Subscriber elevate their permissions to a higher-privileged role. Because the CVSS vector is AV:N/PR:L with high confidentiality, integrity, and availability impact, an attacker holding any low-level account - trivially obtained on sites with open registration - can gain administrative-level control over the booking system and potentially the wider WordPress instance. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated privilege escalation in the WP BASE Booking WordPress plugin (versions through 5.9.0) allows remote attackers to elevate privileges without credentials, with potential to fully compromise affected WordPress sites. The flaw is rated CVSS 8.1 (high) with no public exploit identified at time of analysis, but the unauthenticated nature and high impact on confidentiality, integrity, and availability make it a notable risk for sites running the plugin.
Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. No public exploit code or active exploitation has been identified at time of analysis.