PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39525 Booking Activities Team CVE debrief

CVE-2026-39525 is a MEDIUM severity vulnerability with a CVSS score of 6.5. It is an Unauthenticated Broken Access Control issue affecting Booking Activities plugin versions <= 1.16.48.1.

Vendor
Booking Activities Team
Product
Booking Activities
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of Booking Activities plugin versions <= 1.16.48.1 should apply patches or mitigations to prevent exploitation.

Technical summary

The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L and is classified under CWE-862. It was published on [2026-06-15T21:16:46.707Z](https://www.cve.org/CVERecord?id=CVE-2026-39525) and last modified on [2026-06-15T21:24:32.790Z](https://nvd.nist.gov/vuln/detail/CVE-2026-39525).

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply patches or updates for Booking Activities plugin to version > 1.16.48.1.
  • Review and restrict access controls for the Booking Activities plugin.

Evidence notes

Evidence from Patchstack indicates this vulnerability exists; however, vendor and product details are not confirmed.

Official resources

CVE-2026-39525 was published on 2026-06-15T21:16:46.707Z and last modified on 2026-06-15T21:24:32.790Z.