{"id":"CVE-2026-116406","kind":"vulnerability","aliases":["CVE-2026-116406"],"related":[],"title":"Webba Booking Lite WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.","summary":"The Webba Booking Lite WordPress plugin has a missing authorization check that allows access controls to be bypassed. The sources do not say what data or actions an attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","webba-booking-lite","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look for the `webba-booking-lite` plugin in the WordPress admin plugin list and note its version\n- Compare the installed version against the affected range (n/a through `6.5.4`)","fix":"- Move the Webba Booking Lite plugin to a version later than `6.5.4`; the sources do not name the exact fixed release","status":"open","published_at":"2026-10-29T15:17:19+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:27:07+00:00","updated_at":"2026-10-29T15:27:07+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:27:07Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Webba Booking Lite plugin to a version later than `6.5.4`; the sources do not name the exact fixed release","reach":"internet","title":"Webba Booking Lite WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"The Webba Booking Lite WordPress plugin has a missing authorization check that allows access controls to be bypassed. The sources do not say what data or actions an attacker gains beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","webba-booking-lite","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach booking access controls; exact impact unknown","analyst_note":"Confirm the fixed version and the exact privilege or data exposed from the NVD entry or the Wordfence/plugin advisory.","how_to_check":"- Look for the `webba-booking-lite` plugin in the WordPress admin plugin list and note its version\n- Compare the installed version against the affected range (n/a through `6.5.4`)","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Webba Booking Lite WordPress plugin at version 6.5.4 or earlier are affected. The sources do not say whether the flaw needs a logged-in account or a particular plugin setting. Sites that do not use this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4120,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116406':14A,17A '-2026':13A,16A '6.5.4':85C 'access':10A,40B,74C 'action':53B 'affect':79C 'allow':39B,70C 'attack':55B 'author':7A,36B,59C 'beyond':57B 'book':2A,24B,29B,65C,68C,81C 'bypass':44B 'check':8A,37B 'configur':73C 'control':11A,41B,75C 'cve':12A,15A 'data':51B 'exploit':71C 'expos':9A 'gain':56B 'host':21B 'incorrect':72C 'issu':78C 'levels.this':77C 'lite':3A,25B,30B,69C 'miss':6A,35B,58C 'n/a':83C 'packag':18B 'plugin':5A,32B,63C 'say':49B 'secur':76C 'self':20B 'self-host':19B 'sourc':46B 'vulner':60C 'webba':1A,23B,28B,62C,64C,67C,80C 'webba-booking-lit':22B,66C 'wordpress':4A,26B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Webba Booking Lite WordPress plugin at version 6.5.4 or earlier are affected. The sources do not say whether the flaw needs a logged-in account or a particular plugin setting. Sites that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116406","severity":null,"published_at":"2026-10-29T15:17:19+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}