CVE-2026-27389
Authentication Bypass in WeDesignTech Ultimate Booking Addon
Publication date: 2026-03-05
Last updated on: 2026-03-09
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wedesigntech | ultimate_booking_addon | From 1.0.0 (inc) to 1.0.1 (inc) |
| wedesigntech | ultimate_booking_addon | to 1.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27389 is a high-severity authentication bypass vulnerability in the WordPress WeDesignTech Ultimate Booking Addon Plugin versions up to and including 1.0.1.
This vulnerability allows unauthenticated attackers to perform actions that are normally restricted to higher privileged users by exploiting an alternate path or channel for authentication.
It is classified under OWASP Top 10 A7: Identification and Authentication Failures.
How can this vulnerability impact me? :
This vulnerability can allow attackers to gain administrative access to the affected website without proper authentication.
Such unauthorized access can lead to full control over the website, including modifying content, stealing sensitive data, or deploying malicious code.
The CVSS score of 9.8 indicates a critical risk and a high likelihood of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
This vulnerability allows unauthenticated attackers to gain administrative access to affected websites using the WeDesignTech Ultimate Booking Addon Plugin versions up to 1.0.1.
No official patch is currently available for this plugin.
Users are strongly advised to apply Patchstack’s mitigation rule immediately, which can block attacks targeting this vulnerability until an official fix is released.