CVE-2026-123064

Name of the Vulnerable Software and Affected Versions WP BASE Booking of Appointments, Services and Events versions prior to 6.5.1

Description Insufficient restriction on user-creation actions allows authenticated users with Subscriber-level access and above to create a new administrator account or grant themselves unauthorized capabilities, leading to privilege escalation.

Recommendations Update the plugin to version 6.5.1 or later.