Description
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
Published: 2026-01-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Broken Access Control
Action: Patch now
AI Analysis

Impact

This vulnerability is a missing authorization flaw that enables attackers to bypass the plugin’s configured security levels and potentially perform unauthorized actions within the WordPress site. The weakness is identified as CWE‑862 and could allow an attacker to elevate privileges or access restricted functionality, compromising data integrity and confidentiality for the affected site.

Affected Systems

WordPress plugin WeDesignTech Ultimate Booking Addon from BuddhaThemes is affected for all versions up to and including 1.0.3.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s web interface, although specific exploitation details are not provided in the advisory. Existing access controls must be verified and upgraded to mitigate this risk.

Generated by OpenCVE AI on April 27, 2026 at 21:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WeDesignTech Ultimate Booking Addon to a version newer than 1.0.3 in order to apply the vendor’s fix
  • Restrict access to the plugin’s administrative features so that only verified administrators can use them
  • If a rapid update is not feasible, disable the plugin until a patched version can be installed

Generated by OpenCVE AI on April 27, 2026 at 21:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Wed, 07 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 06 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Jan 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Tue, 06 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
Title WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:37.877Z

Reserved: 2025-12-31T20:12:23.434Z

Link: CVE-2025-69341

cve-icon Vulnrichment

Updated: 2026-01-06T16:59:15.228Z

cve-icon NVD

Status : Deferred

Published: 2026-01-06T17:15:46.633

Modified: 2026-04-27T21:16:24.420

Link: CVE-2025-69341

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T22:00:16Z

Weaknesses