CVE-2026-25439
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Booknetic plugin contains an Authentication Bypass Using an Alternate Path or Channel vulnerability, allowing authentication abuse. This issue affects versions before 5.10.3.
Risk Assessment
An attacker could gain access to protected functionality or data without valid credentials, potentially leading to a breach of confidentiality and integrity.
Recommendation
Update the Booknetic plugin to version 5.10.3 or later to fix the vulnerability.
Other vulnerabilities in Booknetic
See all- CVE-2026-39746Critical
The Booknetic plugin is vulnerable to SQL Injection (improper neutralization of special elements in SQL commands), allowing an attacker to perform Blind SQL Injection. This issue affects versions before 5.10.3.
- CVE-2025-26926Medium
The Booknetic plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This affects versions before 5.10.4.
Original NVD description (English source)
Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS