WP BASE Booking of Appointments, Services and Events (< 6.5.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-base-booking-of-appointments-services-and-events--6.5.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 15:51:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWP BASE Booking of Appointments, Services and Events: Privilege escalation (CVE-2026-123064)https://feed.craftedsignal.io/briefs/2026-11-wp-base-privesc/Mon, 09 Nov 2026 15:51:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wp-base-privesc/The WP BASE Booking of Appointments, Services and Events plugin before version 6.5.1 contains a vulnerability that allows authenticated subscribers to create administrative accounts and escalate privileges.The WP BASE Booking of Appointments, Services and Events plugin for WordPress is affected by a privilege escalation vulnerability (CVE-2026-123064) due to insufficient access control on a user-creation action. Authenticated users with Subscriber-level access can exploit this flaw to register new administrator accounts. The vulnerability is confirmed in versions prior to 6.5.1.

Impact

An attacker with an active subscriber-level account can achieve full administrative access to the affected WordPress instance, leading to complete site compromise.

Recommendation

  • Update the WP BASE Booking of Appointments, Services and Events plugin to version 6.5.1 or later immediately.
  • Audit the WordPress user database for unauthorized administrator accounts created after the plugin's last update.
  • Temporarily disable user registration functionality if patching cannot be performed immediately.
]]>highadvisorywordpressprivilege-escalationcms