CVE-2026-57746: Booked Authentication Bypass Vulnerability

CVE-2026-57746 Overview

CVE-2026-57746 is a broken access control vulnerability in the Booked WordPress plugin, affecting versions up to and including 3.0.0. The flaw allows authenticated users with subscriber-level privileges to access functionality that should be restricted to higher-privileged roles. The issue is classified under [CWE-862] Missing Authorization.

The vulnerability is exploitable over the network with low attack complexity and requires only low-privileged authentication. Successful exploitation results in high confidentiality impact and low integrity impact on affected WordPress sites.

Critical Impact
Authenticated subscriber accounts can bypass authorization checks in the Booked plugin, exposing sensitive booking data and enabling limited modification of protected resources.

Affected Products

Booked WordPress plugin versions <= 3.0.0
WordPress installations using the Booked appointment booking plugin
Sites permitting subscriber-level user registration with the Booked plugin active

Discovery Timeline

2026-07-02 - CVE-2026-57746 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57746

Vulnerability Analysis

The Booked plugin exposes actions or endpoints that lack proper authorization checks. Authenticated users assigned the WordPress subscriber role can invoke these endpoints and reach functionality intended for administrators or booking managers. The vulnerability falls under the Broken Access Control category, mapped to [CWE-862] Missing Authorization.

Because the attack vector is network-based and requires only low privileges, any site that permits open user registration is at elevated risk. The impact profile emphasizes confidentiality, meaning attackers can read appointment records, customer data, and booking configuration that should remain restricted.

Root Cause

The root cause is missing or incomplete capability checks within plugin action handlers. Instead of validating that the requesting user holds the required WordPress capability, affected code paths accept any authenticated request. This design gap allows subscriber accounts to execute privileged operations exposed by the plugin.

Attack Vector

An attacker registers or obtains a subscriber account on the target WordPress site. The attacker then issues authenticated HTTP requests to Booked plugin endpoints that omit capability enforcement. See the Patchstack Vulnerability Report for full technical details on the affected endpoints.

Detection Methods for CVE-2026-57746

Indicators of Compromise

Unexpected admin-ajax.php or REST API requests to Booked plugin actions originating from subscriber accounts
Booking records created, modified, or exported by users without administrative roles
New subscriber accounts registered shortly before access to Booked plugin endpoints
Anomalous export or read operations against booking data tables

Detection Strategies

Review WordPress access logs for authenticated requests to Booked plugin endpoints from non-privileged user IDs
Correlate user role metadata with plugin action invocations to detect capability mismatches
Enable WordPress audit logging to record role-scoped access to booking data
Monitor plugin action parameters for privileged operations initiated by subscriber sessions

Monitoring Recommendations

Alert on any subscriber-role account accessing /wp-admin/admin-ajax.php with Booked-specific action parameters
Track baseline volume of booking record reads and flag deviations by user role
Log all authentication events and new user registrations for correlation with plugin activity

How to Mitigate CVE-2026-57746

Immediate Actions Required

Update the Booked plugin to a version later than 3.0.0 once the vendor releases a patched build
Restrict new user registration or disable the subscriber role where it is not required
Audit existing subscriber accounts and remove any that are unrecognized or dormant
Review booking data for unauthorized access or modification since the plugin was installed

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and vendor guidance. Apply the fixed release as soon as it becomes available through the WordPress plugin repository.

Workarounds

Deactivate the Booked plugin until a patched version is installed if booking functionality is not business critical
Deploy a Web Application Firewall (WAF) rule to block subscriber-role requests to Booked plugin endpoints
Enforce role-based access using a WordPress capability management plugin to strip unnecessary permissions from subscribers
Disable open user registration under Settings > General until remediation is complete

bash

# Configuration example: disable open user registration via WP-CLI
wp option update users_can_register 0
wp plugin deactivate booked