CVE-2026-123064: WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

Q: Who can exploit this issue?

Any authenticated WordPress user with at least the Subscriber role can exploit the affected plugin's insufficiently restricted user-creation action. An attacker does not need existing administrator privileges.

Q: What access does exploitation provide?

Successful exploitation allows the attacker to create a new WordPress administrator account, giving them administrator-level control of the site.

Q: Which plugin versions are affected?

WP BASE Booking of Appointments, Services and Events versions before 6.5.1 are affected. Updating to version 6.5.1 or later addresses the issue.

Published Nov 9, 2026

Updated

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.

Affected Software

1 affected component

WP BASE Booking of Appointments, Services and Events<6.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP BASE Booking of Appointments, Services and Events to a version that resolves this vulnerability.
Fixed in 6.5.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with at least the Subscriber role can exploit the affected plugin's insufficiently restricted user-creation action. An attacker does not need existing administrator privileges.

What access does exploitation provide?

Successful exploitation allows the attacker to create a new WordPress administrator account, giving them administrator-level control of the site.

Which plugin versions are affected?

WP BASE Booking of Appointments, Services and Events versions before 6.5.1 are affected. Updating to version 6.5.1 or later addresses the issue.

CVE-2026-123064: WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Which plugin versions are affected?