CVE-2026-57746 HIGH

CVE-2026-57746: WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability

Vendor Themerex
Product Booked
Weakness CWE-862 · Missing authorization
Published July 2, 2026
Last update July 2, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

Subscriber Broken Access Control in Booked <= 3.0.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Booked versions up to 3.0.0 lack proper authorization checks, allowing authenticated users to read sensitive data they should not access. An attacker with a low-privilege account can view confidential information by making direct requests to the application. The vulnerability does not allow data modification or system disruption, but the exposure of high-sensitivity information poses a significant risk to site operators.

What an attacker can do

03Attacker Capabilities

Read sensitive data belonging to other users or restricted areas of the application.

Potential impact on your site

04Site Impact

User data and confidential information may be exposed to authenticated attackers with minimal privileges.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site.

Key dates

06Disclosure timeline

July 2, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-13468 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters CVE-2026-9233 Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability