CVE-2025-66530: WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker needs an existing low-privilege account. Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.

Q: Which installations are in scope?

Webba Booking versions through 6.2.1 are affected. The provided data does not identify a fixed release or confirm whether any particular default configuration is vulnerable.

Q: What is the expected security impact?

The reported impact is limited to integrity and is rated low. No confidentiality or availability impact is indicated by the supplied vector.

Published Dec 9, 2025

Updated

Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 6.2.1.

Affected Software

2 affected components

Webba Webba Booking<=6.2.1

wordpress/webba-booking<=6.2.1

Event History

Dec 9, 2025

CVE Published

via MITRE·02:13 PM

Data Sourced

via MITRE·02:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Nov 30, 58290

Event

via MITRE·07:16 PM

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs an existing low-privilege account. Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.

Which installations are in scope?

Webba Booking versions through 6.2.1 are affected. The provided data does not identify a fixed release or confirm whether any particular default configuration is vulnerable.

What is the expected security impact?

The reported impact is limited to integrity and is rated low. No confidentiality or availability impact is indicated by the supplied vector.

CVE-2025-66530: WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which installations are in scope?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which installations are in scope?

What is the expected security impact?