CVE-2026-59541
HighCVSS 8.8Summary
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
Risk Assessment
The organization is at risk of complete takeover of the booking system and potentially the entire WordPress installation.
Recommendation
Update the WP BASE Booking plugin to a version above 6.3.1 that blocks privilege escalation by subscribers.
Other vulnerabilities in WP BASE Booking
See all- CVE-2026-73402Medium
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
- CVE-2026-61962Critical
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
- CVE-2026-39587High
There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.
Original NVD description (English source)
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.