{"id":"CVE-2026-116407","kind":"vulnerability","aliases":["CVE-2026-116407"],"related":[],"title":"Webba Booking Lite WordPress plugin: missing authorization check exposes bookings","description":"Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.","summary":"Webba Booking Lite, a WordPress booking plugin, has a missing authorization check tied to incorrectly configured access control levels. The sources do not say what data or actions an attacker can reach through it.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","webba-booking-lite","wordpress"],"not_affected_if":["plugin-newer-than-6.5.4"],"how_to_check":"- Check the installed version of the `webba-booking-lite` plugin in the WordPress admin under Plugins; the sources say versions through `6.5.4` are affected","fix":"- Move `webba-booking-lite` past `6.5.4`; the sources do not name the fixed version","status":"open","published_at":"2026-10-30T16:17:40+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:25+00:00","updated_at":"2026-10-30T16:32:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T16:32:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move `webba-booking-lite` past `6.5.4`; the sources do not name the fixed version","reach":"internet","title":"Webba Booking Lite WordPress plugin: missing authorization check exposes bookings","impact":"medium","summary":"Webba Booking Lite, a WordPress booking plugin, has a missing authorization check tied to incorrectly configured access control levels. The sources do not say what data or actions an attacker can reach through it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","webba-booking-lite"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources do not describe the data or actions exposed","analyst_note":"Find the vendor advisory or Wordfence entry for CVE-2026-116407 to get the fixed version, the affected endpoint, and what an unauthenticated user can read or change.","how_to_check":"- Check the installed version of the `webba-booking-lite` plugin in the WordPress admin under Plugins; the sources say versions through `6.5.4` are affected\n- unknown for other checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-newer-than-6.5.4"],"who_is_affected":"Sites running the Webba Booking Lite WordPress plugin at version 6.5.4 or earlier are affected according to the sources. The sources do not describe which access control settings or booking data are exposed, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4120,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116407':13A,16A '-2026':12A,15A '6.5.4':82C 'access':39B,71C 'action':50B 'affect':76C 'allow':67C 'attack':52B 'author':7A,33B,56C 'book':2A,10A,20B,24B,28B,62C,65C,78C 'check':8A,34B 'configur':38B,70C 'control':40B,72C 'cve':11A,14A 'data':48B 'exploit':68C 'expos':9A 'incorrect':37B,69C 'issu':75C 'level':41B 'levels.this':74C 'lite':3A,21B,25B,66C 'miss':6A,32B,55C 'n/a':80C 'packag':17B 'plugin':5A,29B,60C 'reach':54B 'say':46B 'secur':73C 'sourc':43B 'tie':35B 'vulner':57C 'webba':1A,19B,23B,59C,61C,64C,77C 'webba-booking-lit':18B,63C 'wordpress':4A,22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Webba Booking Lite WordPress plugin at version 6.5.4 or earlier are affected according to the sources. The sources do not describe which access control settings or booking data are exposed, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116407","severity":null,"published_at":"2026-10-30T16:17:40+00:00","modified_at":"2026-10-30T16:17:40+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}