WordPress Plugin Vulnerabilities

WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

Description

The plugin does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.

Proof of Concept

Affects Plugins

Plugin icon
wp-base-booking-of-appointments-services-and-events
Fixed in 6.5.1

References

CVE
CVE-2026-123064

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Ryan Fabella
Submitter
Ryan Fabella
Verified
Yes
WPVDB ID
9af3dc8d-ee15-448a-b67b-346bdc2669fb

Timeline

Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-07 (about 1 day ago)

Other

Published
Title
Published
2026-10-15
Title
InstaWP Connect < 0.1.4.2 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
Published
2026-08-20
Title
Digits: WordPress Mobile Number Signup and Login <= 9.2 - Unauthenticated Privilege Escalation
Published
2026-06-16
Title
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.5 - Authenticated (Subscriber+) Privilege Escalation
Published
2025-04-02
Title
wpForo Forum < 2.4.4 - Subscriber+ Privilege Escalation
Published
2026-10-08
Title
WooCommerce 9.8.0 - 11.1.2 - Shop Manager+ Privilege Escalation