CVE-2024-32960 HIGH

CVE-2024-32960: WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerability

Vendor Booking Ultra Pro
Product Booking Ultra Pro
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Booking Ultra Pro allows Privilege Escalation.This issue affects Booking Ultra Pro: from n/a through 1.1.12.

Explanation of Vulnerability in Simple Terms

02Summary

Booking Ultra Pro versions up to 1.1.12 contain a privilege management flaw that allows authenticated users with low-level access to perform actions reserved for higher-privilege roles. An attacker with a standard user account can read, modify, or delete sensitive data and disrupt site operations. Update to a version newer than 1.1.12 immediately.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data and disrupt site operations using a low-privilege user account.

Potential impact on your site

04Site Impact

Unauthorized users can access and alter booking data, user information, and site settings without proper authorization.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-4314 The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module CVE-2025-8572 Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration CVE-2026-1994 s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-8787 Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVE-2026-12736 WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint