CVE-2026-27389

Received Received - Intake

Authentication Bypass in WeDesignTech Ultimate Booking Addon

Publication date: 2026-03-05

Last updated on: 2026-03-09

Assigner: Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-05

Last Modified

2026-03-09

Generated

2026-07-06

AI Q&A

2026-03-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27389

EUVD

EUVD-2026-9641

Affected Vendors & Products

Vendor	Product	Version / Range
wedesigntech	ultimate_booking_addon	From 1.0.0 (inc) to 1.0.1 (inc)
wedesigntech	ultimate_booking_addon	to 1.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

CVE-2026-27389 is a high-severity authentication bypass vulnerability in the WordPress WeDesignTech Ultimate Booking Addon Plugin versions up to and including 1.0.1.

This vulnerability allows unauthenticated attackers to perform actions that are normally restricted to higher privileged users by exploiting an alternate path or channel for authentication.

It is classified under OWASP Top 10 A7: Identification and Authentication Failures.

Impact Analysis

This vulnerability can allow attackers to gain administrative access to the affected website without proper authentication.

Such unauthorized access can lead to full control over the website, including modifying content, stealing sensitive data, or deploying malicious code.

The CVSS score of 9.8 indicates a critical risk and a high likelihood of exploitation.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

This vulnerability allows unauthenticated attackers to gain administrative access to affected websites using the WeDesignTech Ultimate Booking Addon Plugin versions up to 1.0.1.

No official patch is currently available for this plugin.

Users are strongly advised to apply Patchstack’s mitigation rule immediately, which can block attacks targeting this vulnerability until an official fix is released.

Hi! I’m here to help you understand CVE-2026-27389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70