CVE-2026-6960
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An arbitrary file upload vulnerability in the BookingPress Pro plugin for WordPress up to version 5.6. Missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function allows unauthenticated attackers to upload arbitrary files to the server.
Risk Assessment
An attacker can upload a malicious file, potentially leading to remote code execution on the server. The vulnerability is exploitable only if a signature custom field is added to the booking form.
Recommendation
It is recommended to update the BookingPress Pro plugin to the latest version that fixes this vulnerability.
Original NVD description (English source)
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.