CVE Intelligence
Analysis AI-assisted

CVE-2026-6960: BookingPress Pro for WordPress: Unrestricted File Upload

The BookingPress Pro plugin for WordPress has an unrestricted file upload flaw (CWE-434) in its booking form validation function, affecting all versions up to and including 5.6. Wordfence rated it Critical with a CVSS 3.1 base score of 9.8, and the record says exploitation without authentication is possible only when a signature custom field is added to the booking form. The CVE is not listed in CISA KEV and the sources consulted do not show confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an unrestricted file upload issue in the BookingPress Pro plugin for WordPress, tracked as CVE-2026-6960 and classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). According to the record, the cause is missing file type validation in the function bookingpress_validate_submitted_booking_form_func. The CNA is Wordfence.

Impact

  • The record gives a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The description states that uploaded files may make remote code execution possible on the affected server.
  • The description states that the issue can be reached by unauthenticated attackers, which is consistent with the PR:N component of the vector.

Affected products and versions

  • Product: BookingPress Pro plugin for WordPress.
  • Range as described: all versions up to and including 5.6.
  • Condition: the issue is exploitable only if a signature custom field is added to the booking form.
  • The structured affected and fixed-version fields in the record are empty, so the range should be confirmed against the vendor and Wordfence data.

Exploitation status

  • The record shows the CVE is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The EPSS probability in the record is 0.00869 (percentile 0.57698), which estimates likelihood of exploitation but does not confirm it.

Remediation and mitigation

  • Identify whether BookingPress Pro is installed and which version is active. Versions up to 5.6 are within the described range.
  • Update to a version released by the vendor after 5.6. The record does not name a fixed version, so confirm the current release on the vendor site or in the Wordfence entry.
  • If an update is not immediately possible, review the booking form configuration and remove the signature custom field if it is not required.
  • Restrict which file types the web server accepts in upload locations and make sure upload directories do not execute scripts.
  • Use a web application firewall or equivalent controls as a temporary layer, and validate their effect in a test environment first.

Detection guidance

  • Inventory WordPress sites for the BookingPress Pro plugin and record installed versions.
  • Review upload directories for unexpected files, especially script or executable types, and for files with recent modification times that do not match normal business activity.
  • Review web server logs for unusual submissions to booking form processing, at a high level, and correlate with file creation events.
  • Consider file integrity monitoring on WordPress directories.

Limitations of the available information

  • The record does not include a fixed version, a vendor advisory text, or a structured affected-version list beyond the description.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-05-21), so the EPSS value should be verified before use.
  • The sources do not state how many sites use a signature custom field, so exposure cannot be estimated from the record.
  • The record status is Deferred, so details may change.

Frequently asked questions

Is CVE-2026-6960 being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted for this analysis. The EPSS value only estimates likelihood.

Under what conditions can the flaw be exploited?

According to the record, exploitation is possible only when a signature custom field has been added to the booking form of an affected BookingPress Pro installation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.