CVE-2025-66530
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.
Risk Assessment
Missing authorization may allow unauthorized users to access functions or data they should not, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the Webba Booking plugin to a version later than 6.2.1 that fixes the missing authorization issue.
Other vulnerabilities in Webba Booking
See all- CVE-2026-97079Medium
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
- CVE-2026-27409Medium
The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.
Original NVD description (English source)
Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 6.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS