CVE-2026-57367

HighCVSS 7.1

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.

Risk Assessment

The risk involves potential privilege escalation by subscribers, leading to unauthorized access to sensitive data or system functions.

Recommendation

Immediately update the WP Booking System plugin to version 5.12.8.1 or later.

Other vulnerabilities in WP Booking System

CVE-2026-108123High
The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.

Original NVD description (English source)

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS