CVE-2026-28161

HighCVSS 8.8

Published: 13/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

Service Finder Booking plugin versions up to 6.2 contain a Subscriber Privilege Escalation vulnerability. A user with subscriber role can gain higher privileges.

Risk Assessment

The risk includes privilege escalation, potentially leading to unauthorized access to administrative functions and security compromise.

Recommendation

Update the Service Finder Booking plugin to the latest version that fixes the privilege escalation issue.

Other vulnerabilities in Service Finder Booking

CVE-2026-28159Medium
Broken Access Control vulnerability in Service Finder Booking up to version 6.2 allows a subscriber to gain unauthorized access to administrative functions.

Original NVD description (English source)

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS