CVE-2026-22341 MEDIUM

CVE-2026-22341: WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability

Vendor Case-Themes
Product Booked
Weakness CWE-288
Published February 20, 2026
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H

What the vulnerability does

01Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.

Explanation of Vulnerability in Simple Terms

02Summary

Booked versions 3.0.0 and earlier contain an authentication weakness that allows high-privileged users to read sensitive data and modify system settings. The vulnerability requires administrator-level access and does not involve user interaction. Confidentiality and availability are significantly impacted.

What an attacker can do

03Attacker Capabilities

Read sensitive data and modify system settings with high-privilege account access.

Potential impact on your site

04Site Impact

Administrators with compromised credentials can access confidential information and alter critical system configurations.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the Booked installation.

Key dates

06Disclosure timeline

February 20, 2026 CVE published
April 28, 2026 Record updated