CVE-2025-66530
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Webba Booking plugin (webba-booking-lite) in versions up to and including 6.2.1 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Webba Booking from n/a through <= 6.2.1.
Risk Assessment
Missing authorization may allow unauthorized users to access functions or data they should not, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the Webba Booking plugin to a version later than 6.2.1 that fixes the missing authorization issue.
Other vulnerabilities in Webba Booking
See all- CVE-2026-107416High
The Webba Booking plugin in versions up to 6.5.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-97079Medium
Insecure Direct Object References (IDOR) vulnerability in Webba Booking up to version 6.5.0. A subscriber can access objects without authorization.
- CVE-2026-116407Medium
The Webba Booking plugin (webba-booking-lite) is affected by a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects Webba Booking from an unspecified version through 6.5.4.
- CVE-2026-116406Medium
The Webba Booking plugin (up to version 6.5.4) is vulnerable to a missing authorization flaw enabling exploitation of improperly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.
- CVE-2026-27409Medium
The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.
Original NVD description (English source)
Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 6.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS