CVE-2026-107416
HighCVSS 7.5Summary
The Webba Booking plugin in versions up to 6.5.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may access resources or perform operations they are not authorized for, potentially resulting in unauthorized changes to the booking system.
Recommendation
Update the Webba Booking plugin to the latest version (above 6.5.2) and review access control configuration.
Other vulnerabilities in Webba Booking
See all- CVE-2026-97079Medium
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
- CVE-2026-27409Medium
The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.
- CVE-2025-66530Medium
The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS