Webba Booking vulnerabilities

3 known CVE vulnerabilities in Webba Booking, translated and rated.

CVE-2026-97079Medium
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
CVE-2026-27409Medium
The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.
CVE-2025-66530Medium
The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS