CVE-2026-24371
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bookingalgorithms | ba_book_everything | to 1.8.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying the version of the BA Book Everything plugin installed on your WordPress site. Specifically, check if the plugin version is less than or equal to 1.8.16, which is vulnerable. There are no specific network detection commands provided. To check the plugin version, you can use WordPress CLI commands such as `wp plugin list` to list installed plugins and their versions. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the BA Book Everything plugin to version 1.8.17 or later, where the issue has been fixed. Additionally, using automated update tools like Patchstack can help apply rapid mitigations. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability is a Missing Authorization issue in the BA Book Everything plugin by bookingalgorithms. It allows attackers to exploit incorrectly configured access control security levels, potentially bypassing restrictions that should prevent unauthorized actions.
How can this vulnerability impact me? :
The impact of this vulnerability could include unauthorized access to booking functions or data within the BA Book Everything system, leading to potential misuse or manipulation of bookings or sensitive information.