Is CVE-2026-97079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97079 being exploited in the wild.

How severe is CVE-2026-97079?

Medium severity, with a CVSS score of 4.3, published 30 September 2026.

Which products and versions are affected?

Webba Plugins Webba Booking <= 6.5.0.

Is there a fix for CVE-2026-97079?

A patch was published on 2026-09-24: patched in version 6.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97079 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97079?

Check whether you run Webba Plugins Webba Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97079: Webba Booking insecure direct object reference in subscribers

Q: Is there a fix for CVE-2026-97079?

A patch was published on 2026-09-24: patched in version 6.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-97079 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-97079?

Check whether you run Webba Plugins Webba Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97079 · Severity: medium · CVSS 4.3 · Published 2026-09-30

Webba Booking is a WordPress plugin that handles event ticket sales and bookings. A flaw allows subscribers to access other users' booking data by manipulating URL parameters, potentially exposing personal information and booking details. This could lead to privacy violations and unauthorized access to sensitive customer information.

Technologies: Webba Plugins Webba Booking. Vendors: Webba Plugins.

Quick answers

Is CVE-2026-97079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97079 being exploited in the wild.
How severe is CVE-2026-97079?: Medium severity, with a CVSS score of 4.3, published 30 September 2026.
Which products and versions are affected?: Webba Plugins Webba Booking <= 6.5.0.
Is there a fix for CVE-2026-97079?: A patch was published on 2026-09-24: patched in version 6.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97079 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97079?: Check whether you run Webba Plugins Webba Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Webba Booking versions 6.5.0 and earlier, allowing authenticated subscribers to retrieve arbitrary user booking data by modifying object identifiers in HTTP requests. The vulnerability requires subscriber-level authentication and does not involve network-based attacks. The flaw has been patched in version 6.5.2.

Affected products

Webba Plugins Webba Booking <= 6.5.0

Timeline

2026-09-24: disclosed
2026-09-24: patched: patched in version 6.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.