CVE-2026-39587
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.
Risk Assessment
An attacker could exploit this vulnerability to gain elevated privileges in the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update WP BASE Booking to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP BASE Booking
See all- CVE-2026-73402Medium
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
- CVE-2026-59541High
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
- CVE-2026-61962Critical
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
Original NVD description (English source)
Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.