CVE-2026-39525
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Booking Activities versions up to 1.16.48.1 have a vulnerability in access control that allows unauthorized access.
Risk Assessment
Organizations may be exposed to unauthorized actions within the system, potentially leading to data loss or user privacy breaches.
Recommendation
It is recommended to update to the latest version to mitigate this security vulnerability.
Other vulnerabilities in Booking Activities
See all- CVE-2026-97248Critical
The Booking Activities plugin in versions up to and including 1.18.7.1 is vulnerable to unauthenticated PHP object injection. An attacker can exploit this flaw without logging in.
- CVE-2026-28176High
Booking Activities plugin versions up to 1.18.4 contain an unauthenticated PHP Object Injection vulnerability. An attacker without authentication can inject malicious PHP objects.
Original NVD description (English source)
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS