CPE
The WP BASE Booking of Appointments, Services and Events plugin before version 6.5.1 contains a vulnerability that allows authenticated subscribers to create administrative accounts and escalate privileges.