# CVE-2026-118086: WP BASE Booking privilege escalation

Source: https://junglewise.ai/threats/cve-2026-118086-subscriber-privilege-escalation-in-wp-base-booking-6-5-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118086 · Severity: high · CVSS 8.8 · Published 2026-10-30

WP BASE Booking is a WordPress plugin that manages appointment and event bookings. A privilege escalation flaw in versions 6.5.2 and earlier allows a subscriber—a low-privilege user with minimal site access—to gain full administrator access and control the entire WordPress site. An attacker with a subscriber account could take over the site, modify content, steal data, or inject malicious code.

Technologies: [WP BASE Booking](https://junglewise.ai/threats/technologies/wp-base-wp-base-booking). Vendors: [WP BASE](https://junglewise.ai/threats/vendors/wp-base).

## Quick answers

**Is CVE-2026-118086 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118086 being exploited in the wild.

**How severe is CVE-2026-118086?** High severity, with a CVSS score of 8.8, published 30 October 2026.

**Which products and versions are affected?** WP BASE Booking 6.5.2 and earlier.

**Is there a fix for CVE-2026-118086?** No fixed version is recorded yet. Update the plugin to a patched version when available. As immediate action, restrict subscriber account creation and deactivate the plugin if it cannot be updated. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118086 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118086?** Check whether you run WP BASE Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Update the plugin to a patched version when available. As immediate action, restrict subscriber account creation and deactivate the plugin if it cannot be updated.

## Technical details

A privilege escalation vulnerability in WP BASE Booking allows a subscriber-level user to elevate their privileges to administrator through an unspecified authentication failure. The vulnerability requires only a subscriber account (the lowest authenticated role in WordPress) to exploit, making it accessible to many users. No patch has been released as of the advisory date.

## Affected products

- WP BASE Booking 6.5.2 and earlier

## Timeline

- 2026-10-30: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [WP BASE Booking SQL injection via subscriber privilege](https://junglewise.ai/threats/cve-2026-103066-improper-neutralization-of-special-elements-used-in-an-sql)