WordPress Plugin Vulnerabilities

Booking Activities < 1.16.45 - Unauthenticated Privilege Escalation

Description

The Booking Activities plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.16.44. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
booking-activities
Fixed in 1.16.45

References

CVE
CVE-2025-67953
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b37050-b320-4c59-8d93-db611aa55283

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
570cc2d4-24d7-4f08-bbcb-c7e19e319a69

Timeline

Publicly Published
2026-01-20 (about 6 months ago)
Added
2026-01-28 (about 5 months ago)
Last Updated
2026-01-28 (about 5 months ago)

Other

Published
Title
Published
2020-03-31
Title
WordPress SEO Plugin - Rank Math < 1.0.41 - Privilege Escalation via Unprotected REST API Endpoint
Published
2026-05-01
Title
Import and export users and customers < 2.0.9 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
Published
2025-01-03
Title
WPGuppy < 1.1.1 - Subscriber+ Privilege Escalation
Published
2025-07-22
Title
Social Streams <= 1.2.1 - Subscriber+ Privilege Escalation
Published
2026-06-01
Title
AI Chatbot & Workflow Automation by AIWU < 1.4.19 - Unauthenticated Privilege Escalation