Is CVE-2026-116407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116407 being exploited in the wild.

How severe is CVE-2026-116407?

Medium severity, with a CVSS score of 5.4, published 30 October 2026.

Which products and versions are affected?

Webba Plugins Webba Booking up to 6.5.4.

Is there a fix for CVE-2026-116407?

Yes: fixed in 6.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116407 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116407?

Check whether you run Webba Plugins Webba Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116407: Webba Booking broken access control vulnerability

CVE-2026-116407 · Severity: medium · CVSS 5.4 · Published 2026-10-30

Webba Booking is a WordPress plugin that manages event and class bookings. A broken access control flaw allows subscribers and other unprivileged users to view and perform actions they should not be permitted, such as accessing other users' booking data or modifying bookings without authorization. This could lead to privacy breaches or disruption of booking integrity.

Technologies: Webba Plugins Webba Booking. Vendors: Webba Plugins.

Quick answers

Is CVE-2026-116407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116407 being exploited in the wild.
How severe is CVE-2026-116407?: Medium severity, with a CVSS score of 5.4, published 30 October 2026.
Which products and versions are affected?: Webba Plugins Webba Booking up to 6.5.4.
Is there a fix for CVE-2026-116407?: Yes: fixed in 6.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116407 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116407?: Check whether you run Webba Plugins Webba Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.5.5

Technical details

The vulnerability is a broken access control issue in Webba Booking versions up to 6.5.4, stemming from incorrectly configured access control security levels. An attacker with subscriber-level or higher privileges can bypass authorization checks to access or manipulate protected resources. The flaw is exploitable via the web interface and requires only a user account on the affected WordPress site.

Affected products

Webba Plugins Webba Booking up to 6.5.4

Timeline

2026-10-22: disclosed: Vulnerability reported
2026-10-30: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.