PT-2026-50298
CVE-2026-27400
·
Published
2026-06-12
·
Updated
2026-06-18
Description by
CVSS 3.1
8.6
HighMetricsAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
BookPro versions prior to 1.1.1
Description
The BookPro - Appointment Booking WordPress Plugin contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation, which can lead to remote code execution if critical files, such as
wp-config.php, are deleted.Recommendations
Update the plugin to a version later than 1.1.0.
Found an issue in the description? Have something to add? Feel free to write us 👾