rootpwn

low · CVSS v3 2.7 · EPSS 0.00132

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one o…

Description

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.

Scores

Severity
low
CVSS v2
3.3
CVSS v3
2.7
CVSS v4
—
EPSS
0.00132

← All CVEs

Related CVEs

low

CVE-2026-88844

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

View analysis

low

CVE-2026-89008

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.

View analysis

low

CVE-2026-68493

An authorization bypass vulnerability exists in the circle membership retrieval functionality. A malicious authenticated user must guess a complex 62^15 unique identifier to successfully access membership lists for unauthorized circles. This flaw matters because it exposes membership data to users who lack the appropriate permissions, violating the principle of least privilege.

View analysis

low

CVE-2026-91017

The Robokassa payment gateway plugin for WooCommerce prior to version 1.8.9 fails to validate incoming payment notifications when the non-default deferred-payment feature is enabled. This flaw allows unauthenticated remote actors to forge payment notifications, altering arbitrary WooCommerce order statuses without completing a valid transaction. It matters because it can lead to financial and fulfillment discrepancies if exploited.

View analysis