Privilege escalation in WP BASE Booking of Appointments plugin
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The WP BASE Booking of Appointments, Services and Events WordPress plugin from 6.5.0 before 6.5.1 does not properly restrict access to one of its user-creation actions. An authenticated user with Subscriber-level access or higher can create a new administrator account and escalate their privileges. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WP BASE Booking of Appointments, Services and Events | 6.5.0 to before 6.5.1 | 6.5.1 | Patch available | CNA |
- WP BASE Booking of Appointments, Services and Events VendorUnknown Affected 6.5.0 to before 6.5.1 Fixed in 6.5.1 Patch available CNA
Remediation
Update the WP BASE Booking of Appointments, Services and Events plugin to version 6.5.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA WP BASE Booking of Appointments, Services and Events (Unknown) Fixed in 6.5.1
Timeline
- 2026-11-09 Threatist record created from CVE-2026-123064
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences