CVE-2026-25444
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WpBookingly plugin for WordPress up to version 1.2.9 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, potentially leading to privilege escalation.
Recommendation
Update the WpBookingly plugin to the latest version and implement proper access controls.
Other vulnerabilities in WpBookingly
See all- CVE-2026-66687Medium
Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.
- CVE-2026-27405Medium
Missing authorization vulnerability in the WpBookingly plugin for WordPress allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.