{"id":"CVE-2026-123064","published":"2026-11-09T07:17:29.210","lastModified":"2026-11-10T16:28:46.510","description":"The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9af3dc8d-ee15-448a-b67b-346bdc2669fb/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP BASE Booking WordPress plugin before version 6.5.1 fails to enforce proper access controls on a user-creation endpoint, permitting authenticated users with Subscriber-level privileges or higher to create new administrator accounts. This allows privilege escalation from low-privilege to full administrative control of the WordPress site.","exploitability":"Exploitation requires only valid authenticated credentials at Subscriber level or above and no additional conditions; it is straightforward for any compromised or low-privilege account.","blast_radius":"Successful exploitation grants attackers full administrative control over the WordPress installation, enabling complete site compromise including data theft, malware deployment, and lateral movement.","remediation":"Upgrade to WP BASE Booking plugin version 6.5.1 or later, which patches the insufficient access control on the user-creation action.","detection":"Defenders should monitor WordPress debug logs and audit logs for unexpected creation of administrator-level users by accounts with only Subscriber or lower privileges; specifically, look for wp_insert_user() calls initiated by non-administrative roles in the wp_users table insert events.","tags":["privilege-escalation","auth-bypass","wordpress","plugin-vuln"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:46:49.487Z"}}