CVE-2025-68976

MediumCVSS 5.4

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

The Eagle Booking plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.4.3.

Risk Assessment

An attacker may gain access to booking functions without proper permissions, potentially leading to unauthorized changes in bookings or customer data.

Recommendation

Update the Eagle Booking plugin to the latest version that includes the security fix.

Other vulnerabilities in Eagle Booking

CVE-2025-68975Medium
The Eagle Booking plugin (eagle-booking) in versions up to and including 1.3.4.3 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS