CVE-2026-97079
MediumCVSS 4.3Summary
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
Risk Assessment
Risk of exposure of sensitive data or modification of other users' bookings.
Recommendation
Update the Webba Booking plugin to the latest version.
Other vulnerabilities in Webba Booking
See all- CVE-2026-27409Medium
The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.
- CVE-2025-66530Medium
The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.
Original NVD description (English source)
Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS