# CVE-2026-116407: Webba Booking broken access control vulnerability

Source: https://junglewise.ai/threats/cve-2026-116407-missing-authorization-vulnerability-in-webba-plugins-webba  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116407 · Severity: medium · CVSS 5.4 · Published 2026-10-30

Webba Booking is a WordPress plugin that manages event and class bookings. A broken access control flaw allows subscribers and other unprivileged users to view and perform actions they should not be permitted, such as accessing other users' booking data or modifying bookings without authorization. This could lead to privacy breaches or disruption of booking integrity.

Technologies: [Webba Plugins Webba Booking](https://junglewise.ai/threats/technologies/webba-booking). Vendors: [Webba Plugins](https://junglewise.ai/threats/vendors/webba-plugins).

## Quick answers

**Is CVE-2026-116407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116407 being exploited in the wild.

**How severe is CVE-2026-116407?** Medium severity, with a CVSS score of 5.4, published 30 October 2026.

**Which products and versions are affected?** Webba Plugins Webba Booking up to 6.5.4.

**Is there a fix for CVE-2026-116407?** Yes: fixed in 6.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116407 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116407?** Check whether you run Webba Plugins Webba Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.5.5

## Technical details

The vulnerability is a broken access control issue in Webba Booking versions up to 6.5.4, stemming from incorrectly configured access control security levels. An attacker with subscriber-level or higher privileges can bypass authorization checks to access or manipulate protected resources. The flaw is exploitable via the web interface and requires only a user account on the affected WordPress site.

## Affected products

- Webba Plugins Webba Booking up to 6.5.4

## Timeline

- 2026-10-22: disclosed: Vulnerability reported
- 2026-10-30: advisory: Published by Patchstack

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-5-4-broken-access-control-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-5-4-broken-access-control-vulnerability-2?_s_id=cve)

## Related threats

- [Webba Booking broken access control vulnerability](https://junglewise.ai/threats/cve-2026-116406-missing-authorization-vulnerability-in-webba-plugins-webba)
- [Webba Booking insecure direct object reference (IDOR)](https://junglewise.ai/threats/cve-2026-107416-authorization-bypass-through-user-controlled-key-vulnerability)
- [Webba Booking insecure direct object reference in subscribers](https://junglewise.ai/threats/cve-2026-97079-subscriber-insecure-direct-object-references-idor-in-webba)
- [Webba Plugins Webba Booking missing authorization](https://junglewise.ai/threats/cve-2026-27409-webba-plugins-webba-booking-missing-authorization)