CVE-2026-123064
WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.
| Vendor | unknown |
| Product | wp base booking of appointments, services and events |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp base booking of appointments, services and events
Be the first to know when new high vulnerabilities affecting unknown wp base booking of appointments, services and events are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP BASE Booking of Appointments, Services and Events
6.5.0 < 6.5.1
References
Credits
Ryan Fabella WPScan