CVE-2026-39587: WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the WP BASE Booking plugin for WordPress, versions 5.9.0 and below. The flaw is reachable over the network without any credentials, though exploitation requires meeting specific environmental conditions reflected in the high attack complexity rating. Successful exploitation allows an attacker to gain elevated privileges within WordPress, enabling full read, write, and availability impact on the affected installation. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationNot required

  No account or session credentials are needed; the attack path is fully unauthenticated.

• Victim interactionNot required

  The exploit does not require any action from an administrator or other user on the target site.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must satisfy specific environmental conditions, such as particular server-side state or timing requirements, before the privilege escalation succeeds reliably.

Blast Radius

• Attacker gains elevated WordPress privileges, up to and including administrator-level access.
• With elevated access, the attacker can read all stored site data including user credentials, personal information, and booking records.
• The attacker can modify or delete site content, plugin configurations, and persisted database rows.
• The attacker can disrupt availability of the WordPress service by removing core configuration or installing malicious code that destabilizes the application.