CVE-2026-6960

🗓️ 21 May 2026 21:27:50Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 19 Views🌐 WEB

Unauthenticated file upload in BookingPress Pro up to 5.6 via signature field enables code execution.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-6960	21 May 202621:27	–	attackerkb
Circl	CVE-2026-6960	22 May 202607:32	–	circl
CNNVD	WordPress plugin BookingPress Pro 代码问题漏洞	21 May 202600:00	–	cnnvd
Cvelist	CVE-2026-6960 BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field	21 May 202621:27	–	cvelist
EUVD	EUVD-2026-31367	22 May 202600:31	–	euvd
GithubExploit	Exploit for CVE-2026-6960	23 May 202604:22	–	githubexploit
NVD	CVE-2026-6960	21 May 202622:16	–	nvd
Patchstack	WordPress BookingPress Appointment Booking Pro plugin <= 5.6 - Unauthenticated Arbitrary File Upload vulnerability	22 May 202606:47	–	patchstack
Positive Technologies	PT-2026-42552	21 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-6960	5 Jun 202619:18	–	redhatcve

Vulners

Node

repute_infosystems bookingpress_appointment_booking_proRange≤5.6wordpress

[
  {
    "vendor": "Repute Infosystems",
    "product": "BookingPress Appointment Booking Pro",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ed738dc5-7848-4b04-a3fd-317cc366acfa
bookingpressplugin	www.bookingpressplugin.com/

Parameter	Position	Path	Description	CWE
signature	request body	wp-admin/admin-ajax.php	Unauthenticated arbitrary file upload via bookingpress_validate_submitted_booking_form_func	CWE-434

17 Jun 2026 11:01Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

EPSS0.00672

SSVC

CWE-434