CVE-2026-118086

WordPress · WP Base Booking Plugin

WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability

Description

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

Affected Products

Vendor	Product	Versions
WordPress	WP Base Booking Plugin	n/a

References

https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-privilege-escalation-vulnerability?_s_id=cve(vdb-entry)

Related News (2 articles)

Tier E

Hacker News4d ago

Live CVE Feed to Keep Your Agent Up to Speed

→ No new info (linked only)

Tier C

VulDB4d ago

CVE-2026-118086 | WP Base Booking Plugin up to 6.5.2 on WordPress privileges management

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.18.8 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

CWECWE-266

PublishedOct 30, 2026

Last enriched4d agov2

Trending Score26

Source articles2

Independent2

Info Completeness7/14

Missing: versions, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-119977EXP

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Trending: 84

MEDIUMCVE-2026-115958

WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability

Trending: 11

HIGHCVE-2026-107127

Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF

Trending: 6

HIGHCVE-2026-110523

WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

Trending: 6

HIGHCVE-2026-107506

Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

Trending: 6

Pin to Dashboard

Verification

State: verified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 30, 2026

Discovered by ZDM

Oct 30, 2026

Updated: vendor, product

Oct 30, 2026

Version History

Last enriched 4d ago

v2Tier C4d ago

Corrected vendor and product names, upgraded severity from HIGH to CRITICAL, adjusted CVSS estimate to 9.0 based on CRITICAL rating.

vendorproduct

via VulDB

v14d ago

Initial creation