Wpbookingly
Monthly
WpBookingly plugin versions 1.2.9 and earlier contain a local file inclusion vulnerability in their service-booking-manager component that allows authenticated attackers to read arbitrary files from the affected server. An attacker with valid credentials can exploit improper filename validation in PHP include/require statements to access sensitive information on the system. No patch is currently available for this vulnerability.
Stored Cross-Site Scripting in WpBookingly (WordPress plugin by MagePeople Team, versions ≤ 1.3.2) allows a low-privileged attacker - such as an external customer submitting a booking request - to inject malicious scripts into customer-facing input fields that are later rendered unsanitized in the WordPress admin panel. When an administrator views the poisoned booking data, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, low-complexity attack surface makes this a meaningful risk for any site accepting public booking submissions.
Missing authorization checks in the WpBookingly WordPress plugin (versions through 1.2.9) allow authenticated low-privilege users to perform actions beyond their intended permission scope, resulting in unauthorized data modification. Reported by Patchstack and tracked as EUVD-2026-31964, this broken access control flaw (CWE-862) does not require elevated privileges or user interaction, but exploitation is constrained to authenticated sessions. No public exploit code exists and EPSS stands at 0.03% (8th percentile), with SSVC classifying exploitation status as none - making this a low-urgency but legitimate remediation target for WordPress environments with untrusted authenticated users.
Broken access control in the WpBookingly WordPress plugin (Magepeople Inc.) through version 1.2.9 enables network-authenticated high-privilege users to perform unauthorized integrity and availability-impacting actions against the booking management system. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce proper authorization checks on one or more endpoints, allowing exploitation of incorrectly configured access control levels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
WpBookingly plugin versions 1.2.9 and earlier contain a local file inclusion vulnerability in their service-booking-manager component that allows authenticated attackers to read arbitrary files from the affected server. An attacker with valid credentials can exploit improper filename validation in PHP include/require statements to access sensitive information on the system. No patch is currently available for this vulnerability.
Stored Cross-Site Scripting in WpBookingly (WordPress plugin by MagePeople Team, versions ≤ 1.3.2) allows a low-privileged attacker - such as an external customer submitting a booking request - to inject malicious scripts into customer-facing input fields that are later rendered unsanitized in the WordPress admin panel. When an administrator views the poisoned booking data, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, low-complexity attack surface makes this a meaningful risk for any site accepting public booking submissions.
Missing authorization checks in the WpBookingly WordPress plugin (versions through 1.2.9) allow authenticated low-privilege users to perform actions beyond their intended permission scope, resulting in unauthorized data modification. Reported by Patchstack and tracked as EUVD-2026-31964, this broken access control flaw (CWE-862) does not require elevated privileges or user interaction, but exploitation is constrained to authenticated sessions. No public exploit code exists and EPSS stands at 0.03% (8th percentile), with SSVC classifying exploitation status as none - making this a low-urgency but legitimate remediation target for WordPress environments with untrusted authenticated users.
Broken access control in the WpBookingly WordPress plugin (Magepeople Inc.) through version 1.2.9 enables network-authenticated high-privilege users to perform unauthorized integrity and availability-impacting actions against the booking management system. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce proper authorization checks on one or more endpoints, allowing exploitation of incorrectly configured access control levels. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.