Description

Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T22:16:52.157Z",
  "pubdate": "2026-08-24T22:16:52.157Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in the Booking Hub application affecting versions 1.3.0 and below. This security flaw allows authenticated users with low-privileged subscriber accounts to escalate their privileges within the target system, potentially gaining unauthorized administrative access or capabilities reserved for higher-privileged roles. The vulnerability poses significant risk to confidentiality, integrity, and availability of the affected WordPress site or web application platform where Booking Hub is deployed. Exploitation of this flaw requires network access to the target application and authenticated low-privileged access, specifically a subscriber-level account, to interact with vulnerable functions or insecure endpoints. Threat actors possessing valid subscriber credentials can leverage this flaw to bypass role-based access control enforcement mechanisms, thereby compromising the security posture of the host environment.",
  "technicalDetails": "The vulnerability stems from insufficient access control checks and improper authorization enforcement within the Booking Hub product codebase for versions 1.3.0 and below. Specifically, the vulnerable component fails to adequately validate whether the executing user possesses the necessary administrative capabilities before processing sensitive requests or modifying user roles and application settings. The root cause lies in insecure direct object references or missing capability checks within action handlers and function implementations exposed to authenticated users. In terms of attack flow, an authenticated attacker with subscriber privileges initiates requests to vulnerable application endpoints or submits specially crafted parameters designed to invoke privileged routines. Because the underlying logic does not properly sanitize or verify the caller's privilege level against the requested operation, the application processes the request successfully. This payload behavior results in the unauthorized elevation of privileges, granting the attacker administrative control or capabilities exceeding their intended authorization tier. Post-exploitation impact includes full system compromise, unauthorized data modification, injection of malicious content, and complete administrative takeover of the affected Booking Hub instance."
}