CVE-2026-27405 MEDIUM

CVE-2026-27405: WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability

Vendor Magepeople Inc.
Product WpBookingly
Weakness CWE-862 · Missing authorization
Published May 20, 2026
Last update May 20, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

Explanation of Vulnerability in Simple Terms

02Summary

WpBookingly versions up to 1.2.9 lack proper authorization checks, allowing high-privilege users to modify or delete booking data without appropriate permission validation. An authenticated administrator can alter booking records, availability settings, or customer information through direct API or form manipulation. Sites using this plugin should update immediately to prevent unauthorized changes to critical booking functionality.

What an attacker can do

03Attacker Capabilities

A high-privilege user can modify or delete booking data and settings without proper authorization checks.

Potential impact on your site

04Site Impact

Booking records, availability, and customer data can be altered or deleted by any admin user, risking data integrity and customer trust.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

May 20, 2026 CVE published
May 20, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability CVE-2026-9233 Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action CVE-2026-11912 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action CVE-2026-57340 WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability