CVE-2026-123064

Summary

The WP BASE Booking WordPress plugin before version 6.5.1 fails to enforce proper access controls on a user-creation endpoint, permitting authenticated users with Subscriber-level privileges or higher to create new administrator accounts. This allows privilege escalation from low-privilege to full administrative control of the WordPress site.

Exploitability

Exploitation requires only valid authenticated credentials at Subscriber level or above and no additional conditions; it is straightforward for any compromised or low-privilege account.

Blast radius

Successful exploitation grants attackers full administrative control over the WordPress installation, enabling complete site compromise including data theft, malware deployment, and lateral movement.

Detection

Defenders should monitor WordPress debug logs and audit logs for unexpected creation of administrator-level users by accounts with only Subscriber or lower privileges; specifically, look for wp_insert_user() calls initiated by non-administrative roles in the wp_users table insert events.

Prioritized remediation

Upgrade to WP BASE Booking plugin version 6.5.1 or later, which patches the insufficient access control on the user-creation action.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.