CVE-2026-57367 WP Booking System . CVE debrief

Who should care

Defenders responsible for WP Booking System installations, particularly those with subscriber data, should assess exposure and verify access controls.

Why it matters

CVE-2026-57367 is a HIGH severity vulnerability in WP Booking System that allows broken access control, potentially enabling unauthorized access to subscriber data. Defenders should prioritize verifying exposure and assessing subscriber data access controls.

• Potential unauthorized access to subscriber data
• Verification of access controls required to prevent data exposure
• Possible impact on system security and data integrity

Technical summary

The WP Booking System plugin versions prior to 5.12.8.1 contain a broken access control vulnerability. This issue allows unauthorized access to subscriber data. The vulnerability has been assessed as HIGH severity with a CVSS score of 7.1.

Defensive priority

Defenders should prioritize verifying exposure of WP Booking System installations and assessing subscriber data access controls.

Recommended defensive actions

• Verify WP Booking System version and update to 5.12.8.1 or later if necessary
• Assess subscriber data access controls and ensure proper authorization
• Monitor system logs for potential unauthorized access attempts

Evidence notes

The CVE record and NVD entry provide limited information on the vulnerability. Further investigation is required to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.