96 matches found
PT-2026-113589
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally...
Booked < 2.2.6 - Broken Authentication Detection
The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute...
CVE-2026-57746
Subscriber Broken Access Control in Booked = 3.0.0 versions...
CVE-2026-57747
Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...
CVE-2026-57747
Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...
CVE-2026-57746
Subscriber Broken Access Control in Booked = 3.0.0 versions...
EUVD-2026-41302
Subscriber Broken Access Control in Booked = 3.0.0 versions...
CVE-2026-57746 WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booked = 3.0.0 versions...
EUVD-2026-41303
Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...
CVE-2026-57747 WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...
CVE-2026-57747 WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Booked = 3.0.0 versions...
CVE-2026-57747
CVE-2026-57747 is an unauthenticated CSRF vulnerability in the WordPress Booked plugin
CVE-2026-57746 WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booked = 3.0.0 versions...
CVE-2026-57746
CVE-2026-57746 concerns the WordPress Booked plugin (versions up to and including 3.0.0) where a Broken Access Control vulnerability is described. The Initial document notes only the affected software and version range, with the impact stated as access control issues; no root cause, affected file...
WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Booked versions = 3.0.0...
WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Phat RiO in WordPress Plugin Booked versions = 3.0.0...
CVE-2026-57746: Missing Authorization
Subscriber Broken Access Control in Booked = 3.0.0 versions...
PT-2026-55034
Name of the Vulnerable Software and Affected Versions Booked versions prior to 3.0.1 Description Broken access control allows users with subscriber privileges to perform unauthorized actions. Recommendations Update to a version newer than 3.0.0...
PT-2026-55035
Name of the Vulnerable Software and Affected Versions Booked versions prior to 3.0.1 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to execute. Recommendations Update to a version newer...