PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6960 Repute Infosystems CVE debrief

CVE-2026-6960 is a critical arbitrary file upload issue in the BookingPress Pro WordPress plugin. The flaw stems from missing file type validation in the bookingpress_validate_submitted_booking_form_func function, and it affects all versions up to and including 5.6. Because the upload path is reachable without authentication, attackers could upload arbitrary files to the server; the public description notes this may lead to remote code execution. One important constraint is that the issue can only be exploited if a signature custom field has been added to the booking form.

Vendor
Repute Infosystems
Product
BookingPress Appointment Booking Pro
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-05-21
Advisory published
2026-05-21
Advisory updated
2026-05-21

Who should care

WordPress administrators running BookingPress Pro, site owners who use booking forms with signature custom fields, managed hosting providers, and security teams responsible for monitoring file upload paths and plugin exposure.

Technical summary

According to the supplied NVD/Wordfence-derived record, the vulnerability is an unauthenticated arbitrary file upload caused by missing file type validation in bookingpress_validate_submitted_booking_form_func. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching a critical-severity exposure. The weakness is classified as CWE-434. The exploit condition is narrower than the CVSS rating alone suggests: a signature custom field must be present in the booking form for the vulnerable path to be reachable.

Defensive priority

High. Treat as urgent for any exposed BookingPress Pro installation that uses signature custom fields, because unauthenticated file upload can create a direct path to server compromise.

Recommended defensive actions

  • Identify WordPress sites running BookingPress Pro and confirm whether any booking form includes a signature custom field.
  • If the signature custom field is not required, remove or disable it until a fixed version is available.
  • Monitor vendor and Wordfence advisories for a patched release and update immediately once a fix is published.
  • Review web server and WordPress upload directories for unexpected files, especially around booking submission workflows.
  • Check access logs and application logs for suspicious booking form submissions and anomalous file upload activity.
  • Apply compensating controls such as WAF rules, upload restrictions, and least-privilege permissions on writable directories.

Evidence notes

The debrief is based only on the supplied CVE description and official links. The CVE was published and modified at 2026-05-21T22:16:48.643Z. The supplied record cites Wordfence as the source of the vulnerability information and references the BookingPress site and Wordfence advisory. No fixed version, exploitation in the wild, or vendor patch details were provided in the corpus.

Official resources

Publicly disclosed on 2026-05-21. The supplied record does not include coordinated disclosure details beyond the publication timestamp and linked advisory sources.