User Creation Privilege Escalation in WP BASE Booking Plugin by Appointments Services and Events
CVE-2026-123064
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 November 2026
Badges
What is CVE-2026-123064?
The WP BASE Booking of Appointments, Services and Events plugin for WordPress fails to adequately restrict access to certain user-creation functionalities. This oversight allows authenticated users with Subscriber-level permissions or higher to exploit the vulnerability by creating unauthorized administrator accounts, thus elevating their access rights. This flaw emphasizes the necessity for careful management of user roles and permissions in web applications to prevent unauthorized access and escalation of privileges.
Affected Version(s)
WP BASE Booking of Appointments, Services and Events 6.5.0 < 6.5.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.