CVE-2026-27405
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Missing authorization vulnerability in the WpBookingly plugin for WordPress allows exploiting incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to administrative functions or sensitive data.
Recommendation
Update the WpBookingly plugin to the latest available version.
Other vulnerabilities in WpBookingly
See all- CVE-2026-66687Medium
Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.
- CVE-2026-25444Medium
The WpBookingly plugin for WordPress up to version 1.2.9 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS