CVE-2026-116406
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Webba Booking plugin (up to version 6.5.4) is vulnerable to a missing authorization flaw enabling exploitation of improperly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
Risk Assessment
An attacker could bypass access controls and modify bookings, customer data, or booking system configuration, potentially leading to personal data leakage or service disruption. The risk affects data confidentiality and integrity.
Recommendation
Update the Webba Booking plugin to the latest version (above 6.5.4). Verify user permissions and restrict access to administrative functions.
Other vulnerabilities in Webba Booking
See all- CVE-2026-107416High
The Webba Booking plugin in versions up to 6.5.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-97079Medium
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
- CVE-2026-116407Medium
The Webba Booking plugin (webba-booking-lite) is affected by a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects Webba Booking from an unspecified version through 6.5.4.
- CVE-2026-27409Medium
The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.
- CVE-2025-66530Medium
The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.
Original NVD description (English source)
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS