What the vulnerability does
01Description
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.
Explanation of Vulnerability in Simple Terms
02Summary
BookingPress Appointment Booking Pro versions 5.6 and earlier contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the server without authentication, potentially gaining the ability to run their own code on the site. This affects all installations of the plugin up to version 5.6.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server and execute code without needing to log in.
Potential impact on your site
04Site Impact
Complete compromise of the site; attacker can read data, modify content, and take full control.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 21, 2026
CVE published
May 22, 2026
Record updated
