CVE-2026-39587: WP BASE Booking Privilege Escalation Flaw

CVE-2026-39587 Overview

CVE-2026-39587 is an unauthenticated privilege escalation vulnerability in the WP BASE Booking of Appointments, Services and Events WordPress plugin. The flaw affects all versions up to and including 5.9.0. The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment. An unauthenticated remote attacker can leverage this weakness over the network to escalate privileges on a WordPress site running the affected plugin. Successful exploitation can result in administrative control over the targeted WordPress installation.

Critical Impact
Unauthenticated attackers can escalate privileges remotely against WordPress sites running WP BASE Booking <= 5.9.0, leading to full site compromise.

Affected Products

WP BASE Booking of Appointments, Services and Events plugin for WordPress
All plugin versions up to and including 5.9.0
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2026-06-15 - CVE-2026-39587 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39587

Vulnerability Analysis

CVE-2026-39587 stems from incorrect privilege assignment within the WP BASE Booking plugin. The plugin assigns or accepts privilege-related attributes during user-facing operations without enforcing proper authorization checks. An unauthenticated attacker reaching the plugin's exposed endpoints can manipulate these operations to obtain elevated capabilities on the WordPress site.

The vulnerability requires network access to the WordPress site but no authentication or user interaction. Exploitation impacts confidentiality, integrity, and availability of the target environment. The advisory published by Patchstack confirms the issue affects all versions up to 5.9.0 of the plugin.

Root Cause

The root cause is improper enforcement of privilege boundaries [CWE-266]. The plugin code paths responsible for user provisioning, role assignment, or capability handling do not validate the requester's authorization. As a result, privilege-changing operations are exposed to unauthenticated callers rather than restricted to administrative contexts.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the vulnerable plugin endpoints exposed by the WordPress site. The exploitation does not require valid credentials or victim interaction. The reported attack complexity is high, which indicates the attacker must satisfy specific preconditions or timing to achieve the privilege gain. Refer to the Patchstack Vulnerability Report for additional technical context.

No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-39587

Indicators of Compromise

Creation of new WordPress administrator accounts not initiated by site operators.
Unexpected changes to existing user roles or capabilities, especially elevation to administrator.
Anomalous POST or AJAX requests targeting WP BASE Booking endpoints from unauthenticated sources.
New or modified WordPress plugins, themes, or files following requests to the booking plugin.

Detection Strategies

Audit the wp_users and wp_usermeta tables for recently created accounts or modified wp_capabilities entries.
Inspect web server access logs for requests to plugin paths under wp-content/plugins/wp-base-booking-of-appointments-services-and-events/.
Correlate admin-ajax.php and REST API calls invoking plugin actions with subsequent role changes.
Review WordPress audit logs, if installed, for user_register and set_user_role events tied to anonymous sessions.

Monitoring Recommendations

Enable continuous file integrity monitoring on the WordPress installation directory.
Forward web server, PHP, and WordPress logs to a central analytics platform for anomaly detection.
Alert on privilege changes occurring outside change windows or from unrecognized source IP addresses.
Monitor outbound traffic from the WordPress host for signs of post-compromise command and control.

How to Mitigate CVE-2026-39587

Immediate Actions Required

Identify all WordPress sites running WP BASE Booking and confirm the installed plugin version.
Update the plugin to a fixed release published after version 5.9.0 as soon as the vendor makes one available.
If no patched version is available, deactivate and remove the plugin until a fix is published.
Rotate credentials and review all administrator accounts for unauthorized additions.

Patch Information

The Patchstack advisory tracks remediation status for this vulnerability. Site operators should consult the Patchstack Vulnerability Report for current patch availability and apply the vendor-supplied update once released. Verify the upgrade in a staging environment before deploying to production.

Workarounds

Restrict access to the WordPress site or its plugin endpoints using a web application firewall rule blocking unauthenticated calls to booking actions.
Limit access to wp-admin and admin-ajax.php by source IP where operationally feasible.
Disable user registration in WordPress settings if not required for site functionality.
Enforce least-privilege role assignments and remove unused administrator accounts.

bash

# Disable the vulnerable plugin via WP-CLI until a patched version is available
wp plugin deactivate wp-base-booking-of-appointments-services-and-events
wp plugin delete wp-base-booking-of-appointments-services-and-events