Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.3.
Published: 2026-06-17
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Account Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an Authentication Bypass Using an Alternate Path or Channel flaw in the WordPress Booknetic plugin that allows an attacker to authenticate as any user, including administrators, without valid credentials. It affects all versions before 5.10.3 and is classified as an improper authentication mechanism (CWE-288).

Affected Systems

The affected product is the WordPress Booknetic plugin from Booknetic, any version before 5.10.3. Site owners running these versions via WordPress are at risk.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. The EPSS score is <1% and it is not listed in the CISA KEV catalog, so exploitation likelihood remains uncertain, but the unauthenticated nature and popularity of the plugin suggest a moderate‑to‑high potential for active attacks. An attacker can exploit the flaw through the plugin’s authentication endpoints with no special privileges.

Generated by OpenCVE AI on October 29, 2026 at 12:46 UTC.

Remediation

Vendor Solution

Update the WordPress Booknetic plugin to the latest available version (at least 5.10.3).

OpenCVE Recommended Actions

  • Update the Booknetic plugin to the latest available version (at least 5.10.3).
  • If an update is not immediately possible, deactivate or remove the Booknetic plugin until a patch is applied.
  • Implement strict password policies and enable two‑factor authentication for WordPress accounts to reduce the impact of any future authentication flaws.

Generated by OpenCVE AI on October 29, 2026 at 12:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.4. Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.3.
Title WordPress Booknetic plugin < 5.10.4 - Broken Authentication vulnerability WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability

Wed, 28 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions. Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.4.
Title WordPress Booknetic plugin <= 4.8.5 - Account Takeover vulnerability WordPress Booknetic plugin < 5.10.4 - Broken Authentication vulnerability

Wed, 17 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Fs-code
Fs-code booknetic
Wordpress
Wordpress wordpress
Vendors & Products Fs-code
Fs-code booknetic
Wordpress
Wordpress wordpress
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 17 Jun 2026 11:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.
Title WordPress Booknetic plugin <= 4.8.5 - Account Takeover vulnerability
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Fs-code Booknetic
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-29T11:36:02.240Z

Reserved: 2026-02-02T12:53:40.963Z

Link: CVE-2026-25439

cve-icon Vulnrichment

Updated: 2026-06-17T12:37:35.720Z

cve-icon NVD

Status : Deferred

Published: 2026-06-17T13:20:11.343

Modified: 2026-10-29T12:17:12.450

Link: CVE-2026-25439

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T13:00:22Z

Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel