CVE-2026-107416

7.5High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-639

Impact

Unauthenticated remote attackers can access sensitive booking data. They only need network access to the target WordPress site to exploit the broken access control.

Root cause

An insecure direct object reference (IDOR) flaw fails to validate user permissions before serving records referenced by user-controlled keys.

Affected systems

Webba Booking (webba-booking-lite) through 6.5.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to a version newer than 6.5.2 once available; if a patch cannot be applied immediately, deactivate the Webba Booking plugin.

shell

$ wp plugin update webba-booking-lite

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.

References

https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-5-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-107416