Privilege Escalation in WP BASE Booking Plugin by WordPress
CVE-2026-118086

8.8HIGH

Key Information:

Vendor

WordPress
Status
WP Base Booking
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118086?

A privilege escalation vulnerability has been identified in the WP BASE Booking plugin versions equal to or below 6.5.2. This issue allows authenticated users with subscriber-level access to escalate their privileges, potentially enabling them to perform unauthorized actions within the system. As a result, it poses risks to website integrity and user security, making it essential for site administrators to implement updates or apply patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

WP BASE Booking <= 6.5.2

References

https://patchstack.com/database/wordpress/plugin/wp-base-...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

m1ngt | Patchstack Bug Bounty Program
.