CVE-2026-27389

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

9.8 Critical

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.48%Up 0.5 points since Mar 5, 2026

What each source reports

CVE List Score used 9.8

WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability

Record: CVE-2026-27389
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288
Updated: 2026-11-02

EUVDEUVD-2026-9641 9.8

Record: EUVD-2026-9641
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p5mj-rxf6-hc9h 9.8

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes...

Record: GHSA-p5mj-rxf6-hc9h
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288
Updated: 2026-11-02

NVD 9.8

Record: CVE-2026-27389
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288
Updated: 2026-11-02

Affected products

designthemes wedesigntech ultimate booking addon

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27389 is a critical vulnerability (CVSS 9.8) in Designthemes Wedesigntech Ultimate Booking Addon, published March 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. No source names a fixed version.