Description

Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-13T14:17:02.550Z",
  "pubdate": "2026-08-13T14:17:02.550Z",
  "executiveSummary": "An unauthenticated arbitrary code execution vulnerability has been identified in the WP BASE Booking plugin affecting versions 6.3.0 and prior. This severe security flaw allows remote, unauthenticated threat actors to execute arbitrary code within the context of the underlying web server. The vulnerability exposes the affected WordPress installation to complete system compromise, enabling attackers to read or modify sensitive data, install persistent backdoors, pivot deeper into the network, or disrupt business operations. Exploitation requires network access to the target WordPress site without requiring any prior authentication or administrative privileges. Given the absence of access controls on the vulnerable functionality, malicious payloads can be submitted directly via HTTP requests. The risk implications are critical, as successful exploitation grants the attacker full control over the application layer and potentially the hosting environment, depending on server configurations and file permissions.",
  "technicalDetails": "The vulnerability resides in the request handling architecture of the WP BASE Booking plugin, specifically within components processing user-supplied input without adequate sanitization, validation, or authorization checks. In versions 6.3.0 and prior, the application fails to restrict unauthenticated interactions with sensitive execution routines, allowing remote attackers to invoke functionality capable of evaluating or writing arbitrary code.\nThe root cause stems from improper input validation and missing access control enforcement within the affected codebase. When a specially crafted HTTP request is sent by an unauthenticated user, the application processes the untrusted input and passes it to an insecure evaluation or file-writing sink. This architectural flaw bypasses security boundaries established by the WordPress core framework.\nThe attack flow proceeds as follows: First, the unauthenticated attacker discovers the endpoint responsible for handling the vulnerable functionality within the WP BASE Booking plugin. Second, the attacker formulates a malicious payload designed to execute system commands or inline code. Third, the attacker transmits this payload via an HTTP request directly to the vulnerable component over the network. Fourth, the application processes the input without verifying the sender's identity or authorization status. Finally, the vulnerable component executes the payload, granting the attacker arbitrary code execution capabilities on the host server.\nNetwork exposure is fully external, as the vulnerable plugin endpoints are typically accessible via standard HTTP/HTTPS protocols without pre-authentication barriers. Privilege requirements are nonexistent, allowing any anonymous user on the internet to trigger the flaw. Post-exploitation impact includes full system compromise, data exfiltration, lateral movement, and the deployment of persistent malware."
}