CVE-2026-27389 describes an authentication bypass vulnerability in designthemes WeDesignTech Ultimate Booking Addon (versions up to 1.0.1). The vulnerability allows attackers to circumvent authentication by leveraging an alternate path or channel, enabling unauthorized access. The CVSS 3.1 base score is 9.8 (critical), with attack vector network, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. The vulnerability was published on March 5, 2026. There is no patch or official remediation information available from the vendor or other sources at this time. The product is not cloud-hosted, so users must apply any forthcoming patches or mitigations themselves.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls completely, leading to unauthorized access with full control over the affected system's data and functions. This compromises confidentiality, integrity, and availability, potentially allowing data theft, manipulation, or service disruption. Given the critical CVSS score and lack of required privileges or user interaction, the vulnerability poses a severe risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor vendor communications closely for updates. Until a fix is released, consider restricting access to the affected addon or implementing compensating controls such as network-level restrictions to limit exposure.