Critical Code Execution Vulnerability in WP BASE Booking Plugin: Immediate Mitigation Mandatory
Overview
A CVSS 10.0 critical vulnerability (CVE-2026-61962) in the WP BASE Booking WordPress plugin enables unauthenticated attackers to execute arbitrary code serverside, enabling full system compromise. Defense sector and enterprise WordPress deployments should prioritize patching.
Technical Analysis
The flaw resides in untrusted input handling within the plugin's booking form processing endpoints. By crafting HTTP requests with malicious code payloads (e.g., shell uploads), attackers can bypass authentication to achieve remote code execution. Vulnerability exists in versions <= 6.3.0, requiring no user interaction to exploit.
Enterprise & DIB Impact
DIB organizations utilizing this plugin face direct exposure to data exfiltration, ransomware deployment, and lateral movement risks. Attackers could exploit this to access IP, weapon systems data, or critical infrastructure control systems via compromised WordPress backends.
Recommended Actions
- Update to WP BASE Booking v6.3.1+
- disable unused booking endpoints until patched
- implement strict input validation for form submissions
- monitor server logs for anomalous shell script activity
- segment WordPress server networks from critical systems
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →