CVE-2026-57367
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.
Risk Assessment
The risk involves potential privilege escalation by subscribers, leading to unauthorized access to sensitive data or system functions.
Recommendation
Immediately update the WP Booking System plugin to version 5.12.8.1 or later.
Other vulnerabilities in WP Booking System
See all- CVE-2026-57639High
The WP Booking System plugin by Roland Murg up to 2.1.0.6 does not properly neutralize input during web page generation, allowing a Reflected XSS attack. The issue affects versions from n/a through 2.1.0.6.
- CVE-2026-108123High
The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.
Original NVD description (English source)
Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS