CVE-2026-107416: WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/webba-booking-liteto a version that resolves this vulnerability.Fixed in 6.5.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and needs no user interaction. An unauthenticated remote attacker may be able to exploit the affected access-control weakness.
Which versions are affected?
Webba Booking versions through 6.5.2 are affected. The available data does not identify a fixed version.
What is the likely security impact?
The reported CVSS vector assigns high confidentiality impact, with no integrity or availability impact. The issue is an authorization bypass/IDOR condition involving a user-controlled key.