CVE-2026-61962
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
Risk Assessment
Risk includes full server compromise, including takeover of the website and data.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious activities.
Other vulnerabilities in WP BASE Booking
See all- CVE-2026-73402Medium
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
- CVE-2026-59541High
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
- CVE-2026-39587High
There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.
Original NVD description (English source)
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS