CVE Intelligence
Analysis AI-assisted

CVE-2026-56059: Travel Booking WordPress Theme Arbitrary File Upload by Subscriber

CVE-2026-56059 is a critical arbitrary file upload vulnerability in Travel Booking, affecting versions up to and including 2.2.5, as reported by Patchstack. The CNA assigns CVSS 3.1 9.9 and CWE-434, and the record requires only Subscriber-level privileges. The record shows no fixed version and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an arbitrary file upload vulnerability in Travel Booking, affecting versions up to and including 2.2.5. The description refers to Subscriber-level access, and the CWE classification is CWE-434, Unrestricted Upload of File with Dangerous Type.

Impact

  • CVSS 3.1 base score of 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, as provided by audit@patchstack.com.
  • The vector indicates high confidentiality, integrity and availability impact, with a scope change.
  • Unrestricted upload flaws can allow files of unintended types to be stored on a server. The record does not detail the consequences in a specific deployment.

Affected products and versions

  • Product: Travel Booking, versions up to and including 2.2.5, as stated in the record.
  • The Patchstack reference path suggests a WordPress theme (inference).
  • The record contains no structured affected or fixed version entries.

Exploitation status

The record shows kev.listed as false, so this CVE is not reported there as actively exploited. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00479 with percentile 0.39627, dated 2026-10-13.

Remediation and mitigation

  • The record does not identify a fixed version. Check the vendor and the Patchstack advisory for an updated release and apply it when confirmed.
  • Until a fix is confirmed, review which accounts hold Subscriber-level access and whether file upload functions are reachable by them.
  • Keep WordPress core, themes and plugins current, and remove components that are not in use.

Detection guidance

  • Review recently uploaded files in media and theme-related directories for unexpected file types or names.
  • Audit upload activity by low-privilege accounts and check web server logs for unusual requests to uploaded files.
  • Compare file inventories against a known-good baseline to spot unauthorized additions.

Limitations of the available information

  • The record provides no technical exploitation details, no version range beyond the stated maximum, and no fixed version.
  • Vendor response and patch availability are unknown from the record.
  • The source status is Deferred, so details may change as sources are updated.

Frequently asked questions

Which versions of Travel Booking are affected by CVE-2026-56059?

The record states versions up to and including 2.2.5. It does not list a structured range or a fixed version.

Is this vulnerability known to be actively exploited?

The record shows kev.listed as false, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.