CVE-2026-39652

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The iGMS Direct Booking WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.

Risk Assessment

An attacker can manipulate bookings or access sensitive customer data, potentially leading to financial loss and loss of trust.

Recommendation

Update the iGMS Direct Booking plugin to the latest version and configure appropriate access permissions.

Original NVD description (English source)

Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.