External risk intelligence

WP Base Booking Arbitrary Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-61962

The vulnerability affects a WordPress plugin designed for booking appointments and services. Such plugins are deployed on public-facing websites to enable interaction with users or customers, making them internet-accessible by design in typical usage.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an unauthenticated arbitrary code execution vulnerability within a widely used WordPress booking plugin. The issue allows for potential unauthorized control over affected systems, necessitating a review of its presence within the organization's digital footprint. The primary concern at this stage is to confirm whether this specific technology is in use and if it is exposed to external access.

Allows unauthorized code execution remotely.
Important for public-facing website security.
Confirm usage and external exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests over the internet to a vulnerable WordPress site. This bypasses the need for any login or special access. The attack targets the WP BASE Booking plugin, a component designed to manage appointments and services. Successful exploitation allows an attacker to execute arbitrary code, meaning they can run any commands they choose on the server.

No authentication required for attack.
Vulnerable booking plugin component is triggered.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on a server hosting the WP BASE Booking plugin. This could lead to a complete compromise of the affected website and its underlying infrastructure when the plugin is accessible over the network.

Server code execution.
Exploited via network access.
Full website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in unauthenticated arbitrary code execution within WP BASE Booking impacts application owners and potentially infrastructure or platform teams managing WordPress deployments. The immediate practical step is to identify all instances of WP BASE Booking, determine their exposure and business criticality, and then assign an owner for remediation planning.

Application owners should prioritize this issue.
Verify plugin reachability and business impact first.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WP BASE Booking?

WP BASE Booking is a plugin for WordPress sites, designed to manage appointments, services, and events. It acts as an interactive tool that allows visitors to book slots or services directly through a website's interface.

What does arbitrary code execution mean for CVE-2026-61962?

This CVE involves a vulnerability classified as CWE-94, or Improper Control of Generation of Code. In plain terms, it means the plugin fails to properly restrict what commands the system processes. Because of this weakness, an attacker can input and run their own malicious instructions on the server hosting your WordPress site.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted requests over the network to the vulnerable plugin. No authentication or login credentials are required to initiate these requests. It is important to note that simply visiting the site as a regular user does not trigger this; the attacker must specifically target the plugin's processing logic.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies that because WP BASE Booking is intended to be used on public-facing websites for customer interaction, it is inherently internet-accessible. This means your site is likely reachable by attackers, increasing the relevance of this vulnerability if you have the plugin installed.

What should I do first to address this?

Begin by auditing your WordPress environments to identify every installation of WP BASE Booking. Once located, verify which sites are accessible from the internet and determine the business criticality of those specific instances. Assign an owner for each identified site to track the status and coordinate upcoming security updates.

References

patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointm…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.