Subscriber Broken Access Control in Booked <= 3.0.0

Executive Summary

The WordPress Booked Plugin versions 3.0.0 and below contain a Broken Access Control vulnerability identified as CVE-2026-57746.

This vulnerability allows unprivileged users, such as Subscribers, to perform actions that normally require higher privileges due to missing authorization, authentication, or nonce token checks.

It is considered a medium-priority issue with a CVSS score of 7.1, indicating moderate danger and potential for exploitation in widespread attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with low-level access (e.g., Subscribers) to perform higher-privileged actions that they should not be authorized to do.

Such unauthorized actions can lead to unauthorized changes or access within the WordPress site, potentially compromising site integrity and security.

Because there is no official patch yet, the risk remains until mitigations or updates are applied.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability allows unprivileged users (e.g., Subscribers) to perform higher-privileged actions due to missing authorization, authentication, or nonce token checks in the Booked WordPress plugin versions 3.0.0 and below.

Detection involves monitoring for unauthorized access attempts or actions performed by Subscriber-level accounts that should require higher privileges.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Booked plugin to a version higher than 3.0.0 once available.

Until an official patch is released, applying the mitigation rule provided by Patchstack to block attacks is advised.

Seeking assistance from your hosting provider or a developer to implement these mitigations is recommended.

Useful 0 Not Useful 0