CVE-2026-27405

Vulnerability

The WpBookingly plugin for WordPress by Magepeople inc. contains a missing authorization vulnerability in versions from n/a through 1.2.9. The plugin fails to properly validate access control security levels, allowing exploitation of incorrectly configured access controls. [1]

Exploitation

An attacker with network access to the WordPress site can exploit this vulnerability without authentication or user interaction. By sending direct requests to unprotected endpoints, the attacker can access functions that should be restricted to higher-privileged users. [1]

Impact

Successful exploitation allows an unprivileged attacker to perform actions intended for higher-privileged users, such as modifying data or settings. While the impact is considered low severity, the vulnerability may be used in mass-exploit campaigns targeting thousands of websites. [1]

Mitigation

The vulnerability is fixed in version 1.3.0. Users should update to 1.3.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins. No workaround is available besides updating. [1]