Executive Summary

CVE-2026-22341 is a medium severity Broken Authentication vulnerability in the WordPress Booked Plugin versions up to and including 3.0.0.

It allows a malicious actor to bypass authentication by using an alternate path or channel, enabling them to perform actions normally restricted to higher privileged users.

This can potentially allow the attacker to gain administrative access to the affected website.

The vulnerability falls under the OWASP Top 10 category A7: Identification and Authentication Failures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to gain unauthorized administrative access to your WordPress site using the Booked Plugin.

With administrative privileges, the attacker could manipulate site content, steal sensitive information, or disrupt site operations.

Since the exploit requires a custom developer role privilege, sites using such roles are particularly at risk.

No official patch is currently available, so immediate application of mitigation rules is advised to prevent exploitation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about commands or methods to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, users are advised to apply Patchstack’s mitigation rule which blocks exploitation attempts until an official patch is released.

Since no official patch is currently available, applying this mitigation rule is the safest way to protect your site from potential attacks exploiting this authentication bypass vulnerability.

Useful 0 Not Useful 0