{"affected":[{"defaultStatus":"unaffected","product":"WP BASE Booking of Appointments, Services and Events","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.5.1","status":"affected","version":"6.5.0","versionType":"semver"}]}],"cveId":"CVE-2026-123064","cwes":["CWE-269"],"description":"The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/9af3dc8d-ee15-448a-b67b-346bdc2669fb/"}],"kev":null,"metrics":[],"modifiedAt":1794204027831,"publishedAt":1794204027831,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/9af3dc8d-ee15-448a-b67b-346bdc2669fb/"}],"remediation":[],"revision":"41596b19dd853f24d21e0401961c5bb7ca9f06d1f0406a94aace982ab02af3a9","sources":[{"modifiedAt":1794204027831,"name":"CNA: WPScan","retrievedAt":1794208121746,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123064"}],"ssvc":null,"status":"published","title":"WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation","updatedAt":1794208121746}