Junglewise Threat Intelligence

CVE-2026-27400: Ovatheme BookPro arbitrary file deletion via path traversal

CVE-2026-27400 · Severity: high · CVSS 8.6 · Published 2026-06-17

Executive brief

BookPro is a WordPress plugin used for managing bookings and appointments. A security flaw allows an unauthenticated attacker to delete arbitrary files from the web server. This can lead to a complete website outage if critical system or configuration files are removed, potentially requiring a full site restoration from backups.

Technical details

The BookPro plugin for WordPress (versions 1.1.0 and below) is vulnerable to unauthenticated arbitrary file deletion due to improper limitation of a pathname to a restricted directory (CWE-22). An attacker can exploit this path traversal vulnerability via a network request without any prior authentication or user interaction. By manipulating file path parameters, an attacker can delete sensitive files on the server, including WordPress configuration files (wp-config.php) or core system files. This can result in a complete denial of service or, in some configurations, allow the attacker to trigger a re-installation process to gain administrative control. As of the advisory date, no official patch is available.

Affected products

  • Ovatheme BookPro (ovabookpro) <= 1.1.0

Timeline

  • 2025-11-09: other: Vulnerability reported by researcher Phat RiO
  • 2026-06-12: disclosed: Vulnerability details published by Patchstack
  • 2026-06-17: advisory: CVE published in NVD

References