CVE-2026-27405: WpBookingly Authorization Bypass Vulnerability

CVE-2026-27405 Overview

CVE-2026-27405 is a Missing Authorization vulnerability [CWE-862] affecting the Magepeople Inc. WpBookingly WordPress plugin. The flaw exists in all versions up to and including 1.2.9 and allows authenticated attackers to exploit incorrectly configured access control security levels. The plugin, distributed as service-booking-manager, fails to enforce capability checks on sensitive operations. Network-based attackers with high privileges can bypass intended access restrictions to compromise integrity and availability of the booking system.

Critical Impact

Attackers with valid authenticated sessions can perform unauthorized actions on the WpBookingly plugin, leading to integrity and availability impact on booking data and plugin operations.

Affected Products

• Magepeople Inc. WpBookingly plugin (service-booking-manager)
• WpBookingly versions from n/a through 1.2.9
• WordPress installations using the affected plugin

Discovery Timeline

• 2026-05-20 - CVE-2026-27405 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-27405

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the WpBookingly plugin's request handlers. The plugin exposes endpoints that perform state-changing operations without verifying that the calling user holds the required WordPress capability. This category of flaw, classified under CWE-862, occurs when application logic relies on authentication alone instead of also validating authorization for the specific action.

An authenticated user with limited privileges can invoke functions intended for administrators or booking managers. The CVSS vector indicates high privileges are required, suggesting exploitation requires an existing account such as a subscriber or low-level staff user. Successful exploitation does not expose confidential data but enables modification or destruction of booking records.

Root Cause

The root cause is the absence of current_user_can() capability checks and missing nonce validation on privileged plugin actions. WordPress plugins must enforce both authentication and authorization at every request boundary. WpBookingly through version 1.2.9 skips these checks on one or more handlers, allowing any logged-in user to reach functionality reserved for higher-privileged roles.

Attack Vector

The attack vector is network-based and requires authenticated access to the target WordPress site. An attacker submits crafted HTTP requests to the vulnerable plugin endpoints. Because the endpoints do not validate user capabilities, the requests execute with the privileges of the underlying plugin code rather than those of the calling user. The vulnerability manifests when plugin AJAX handlers or admin-post routes process input without role verification. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-27405

Indicators of Compromise

• Unexpected modifications to booking records, customer entries, or service configurations in the WpBookingly database tables
• HTTP POST requests to admin-ajax.php or plugin endpoints originating from low-privileged user sessions
• WordPress audit log entries showing privileged plugin actions executed by subscriber or customer accounts

Detection Strategies

• Enable WordPress activity logging plugins to capture user actions and review entries tied to WpBookingly handlers
• Review web server access logs for requests to service-booking-manager endpoints from non-administrative accounts
• Compare current plugin database tables against known-good backups to identify unauthorized changes

Monitoring Recommendations

• Monitor for anomalous AJAX action parameters referencing booking management functions from non-admin sessions
• Alert on bulk modification or deletion operations against booking-related tables outside normal business hours
• Track creation of new bookings, services, or staff entries that lack a corresponding administrator action

How to Mitigate CVE-2026-27405

Immediate Actions Required

• Update the WpBookingly plugin to a version later than 1.2.9 once the vendor publishes a fix
• Audit existing WordPress user accounts and remove or disable unused low-privilege accounts that could be leveraged for exploitation
• Restrict registration of new accounts on WordPress sites running the affected plugin until patched

Patch Information

No fixed version is identified in the available advisory data at the time of publication. Administrators should consult the Patchstack Vulnerability Report and the Magepeople vendor page for updates and apply the patched release as soon as it becomes available.

Workarounds

• Deactivate the WpBookingly plugin until a patched version is released if the booking functionality is non-essential
• Deploy a Web Application Firewall rule to block unauthenticated and low-privilege requests to plugin-specific endpoints
• Limit wp-admin and admin-ajax.php access by IP allowlist where operationally feasible

# Configuration example: deactivate the plugin via WP-CLI until a patch is available
wp plugin deactivate service-booking-manager
wp plugin status service-booking-manager