WP BASE Booking of Appointments, Services and Events: Privilege escalation (CVE-2026-123064)
The WP BASE Booking of Appointments, Services and Events plugin before version 6.5.1 contains a vulnerability that allows authenticated subscribers to create administrative accounts and escalate privileges.
CVE search metadata
CVE search record: CVE-2026-123064. Severity: high. CVSS: 8.8. KEV: no. Product: WP BASE Booking of Appointments, Services and Events (< 6.5.1). Brief: WP BASE Booking of Appointments, Services and Events: Privilege escalation (CVE-2026-123064). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wp-base-privesc/
Triage facts
Revision 1- Applicability
- WP BASE Booking of Appointments, Services and Events (< 6.5.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 15:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is affected by a privilege escalation vulnerability (CVE-2026-123064) due to insufficient access control on a user-creation action. Authenticated users with Subscriber-level access can exploit this flaw to register new administrator accounts. The vulnerability is confirmed in versions prior to 6.5.1.
Impact
An attacker with an active subscriber-level account can achieve full administrative access to the affected WordPress instance, leading to complete site compromise.
Recommendation
- Update the WP BASE Booking of Appointments, Services and Events plugin to version 6.5.1 or later immediately.
- Audit the WordPress user database for unauthorized administrator accounts created after the plugin's last update.
- Temporarily disable user registration functionality if patching cannot be performed immediately.
Immediate actions
Upgrade WP BASE Booking of Appointments, Services and Events to 6.5.1
Threat Hunt
Hunt for unauthorized administrator account creation events
Data: WordPress user_register action hooks, Audit logs showing new user creation by existing subscribers, Database logs (wp_users and wp_usermeta) for role changes
Mitigations
Upgrade plugin to 6.5.1
CVE-2026-123064