Now officially on WordPress.org

CVE Database / CVE-2026-57746

CVE

CVE-2026-57746 — Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-57746 Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization — Unknown not specified no fix on file — —

CVE-2026-57746

Authenticated users with subscription level permissions or higher can exploit a security flaw in the Booked plugin for WordPress, which affects versions prior to 3.0.1, allowing them to bypass intended access controls. The vulnerability stems from an oversight in capability checks within the plugin's functionality. This issue enables unauthorized actions by authorized users.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings