An unauthenticated vulnerability exists in versions of the WP BASE Booking plugin for WordPress that allows an attacker to execute arbitrary PHP code on the affected site. The flaw, identified as CWE‑94, permits remote code execution because the plugin does not properly validate or restrict the data it processes. Successful exploitation would give an attacker full control over the WordPress installation, enabling installation of backdoors, data exfiltration, or domain takeover.

The issue affects the WP BASE Booking plugin developed by Hakan Ozevin, specifically all releases up to and including version 6.3.0. No further version detail is available, so any deployment of the plugin at or below this release is potentially vulnerable. WordPress sites that rely on this plugin should review their current version against the vendor’s advisory.

The CVSS score of 10 denotes the highest severity. With no EPSS data, the exploitation likelihood cannot be quantified, but the lack of an authentication requirement means any user able to trigger the plugin’s functionality can attempt the attack. The vulnerability is not yet listed in the CISA KEV catalog, but given its remote code execution nature, it poses a critical risk and should be addressed immediately.