{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wp-base/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp_base:wp_base_booking_of_appointments_services_and_events:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-123064"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP BASE Booking of Appointments, Services and Events (\u003c 6.5.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","cms"],"_cs_type":"advisory","_cs_vendors":["WP BASE"],"content_html":"\u003cp\u003eThe WP BASE Booking of Appointments, Services and Events plugin for WordPress is affected by a privilege escalation vulnerability (CVE-2026-123064) due to insufficient access control on a user-creation action. Authenticated users with Subscriber-level access can exploit this flaw to register new administrator accounts. The vulnerability is confirmed in versions prior to 6.5.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker with an active subscriber-level account can achieve full administrative access to the affected WordPress instance, leading to complete site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the WP BASE Booking of Appointments, Services and Events plugin to version 6.5.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress user database for unauthorized administrator accounts created after the plugin's last update.\u003c/li\u003e\n\u003cli\u003eTemporarily disable user registration functionality if patching cannot be performed immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:39Z","date_published":"2026-11-09T15:51:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wp-base-privesc/","summary":"The WP BASE Booking of Appointments, Services and Events plugin before version 6.5.1 contains a vulnerability that allows authenticated subscribers to create administrative accounts and escalate privileges.","title":"WP BASE Booking of Appointments, Services and Events: Privilege escalation (CVE-2026-123064)","url":"https://feed.craftedsignal.io/briefs/2026-11-wp-base-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - WP BASE","version":"https://jsonfeed.org/version/1.1"}