CVE-2026-116406: WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.

Q: What is the likely impact of successful exploitation?

The reported impact is limited to integrity, with no stated confidentiality or availability impact. Successful exploitation could allow unauthorized modification within the affected access-control scope.

Q: Which versions should be treated as affected?

Webba Booking versions through 6.5.4 are affected. The available data does not identify a fixed version.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Webba Booking to a version that resolves this vulnerability.
Fixed in 6.5.5

Event History

Oct 29, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation does not require user interaction and can be performed over the network.

What is the likely impact of successful exploitation?

The reported impact is limited to integrity, with no stated confidentiality or availability impact. Successful exploitation could allow unauthorized modification within the affected access-control scope.

Which versions should be treated as affected?