CVE-2026-27405 Magepeople inc. CVE debrief

Who should care

WordPress site owners running WpBookingly, administrators responsible for plugin access controls, and security teams that review privilege boundaries in customer-facing booking or management plugins.

Technical summary

The supplied CVE description identifies a missing authorization weakness in Magepeople inc. WpBookingly, described as exploiting incorrectly configured access control security levels. NVD maps the weakness to CWE-862 and reports the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, indicating network reachability, low attack complexity, no user interaction, and high privileges required. The affected range is listed as from n/a through 1.2.9. NVD also marks the vulnerability status as Deferred in the provided record.

Defensive priority

Medium. Prioritize if the plugin is installed and any privileged roles or admin-facing workflows are exposed. Because the issue is authorization-related, validating server-side permission checks should be a high-confidence remediation step even if no active exploitation is known.

Recommended defensive actions

• Inventory all WordPress installations that use WpBookingly and confirm the installed version.
• Upgrade or replace WpBookingly if an unaffected release is available from the vendor or trusted maintainer.
• Review all admin, AJAX, REST, and action-handler endpoints for server-side authorization checks; do not rely on UI-only restrictions.
• Restrict plugin management access to the minimum necessary administrative roles.
• Monitor WordPress logs and plugin activity for unexpected privilege-sensitive actions until remediation is complete.

Evidence notes

All claims here are limited to the supplied corpus. The CVE description states: "Missing Authorization vulnerability in Magepeople inc. WpBookingly" and notes impact from n/a through 1.2.9. The provided NVD metadata lists weakness CWE-862, CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, and vulnStatus Deferred. The supplied reference URL points to a Patchstack advisory for the WpBookingly plugin. No KEV entry is present in the supplied enrichment data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.