Live › vulnerability › CVE-2026-118086
WP BASE Booking, a WordPress booking plugin, up to and including version 6.5.2 lets a low-privilege Subscriber account gain higher privileges. An attacker with a basic site account could take control of the site's administrative functions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running WP BASE Booking version 6.5.2 or earlier that allow users to register or hold Subscriber accounts are exposed. Sites without this plugin, or with it on a version newer than 6.5.2, can skip it. The sources do not say whether default settings are affected.
No product ranges from the sources yet.
wp-base-booking or the plugin's folder in wp-content/plugins/.6.5.2 (the sources do not name the exact fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118086")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.