CVE-2026-65466

MediumCVSS 4.9

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The JetBooking plugin version 4.1.2 and earlier is vulnerable to SSRF attacks from a custom role. A user with a custom role can send requests to internal network resources.

Risk Assessment

The risk includes potential internal network scanning, access to sensitive services, or using the server as a proxy for attacks on other systems.

Recommendation

It is recommended to update the JetBooking plugin to a version above 4.1.2 that includes an SSRF fix.

Other vulnerabilities in JetBooking

CVE-2026-65468Medium
The JetBooking plugin version 4.1.2 and earlier contains a broken access control vulnerability that can be exploited without authentication. An attacker can gain unauthorized access to functions or data.

Original NVD description (English source)

Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS