CVE-2026-28159

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Broken Access Control vulnerability in Service Finder Booking up to version 6.2 allows a subscriber to gain unauthorized access to administrative functions.

Risk Assessment

Subscribers may access sensitive functions, potentially leading to data integrity issues or unauthorized changes.

Recommendation

Update Service Finder Booking to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Service Finder Booking

CVE-2026-28161High
Service Finder Booking plugin versions up to 6.2 contain a Subscriber Privilege Escalation vulnerability. A user with subscriber role can gain higher privileges.

Original NVD description (English source)

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS