CVE-2026-27389 describes an authentication bypass vulnerability in the WeDesignTech Ultimate Booking Addon by designthemes, affecting versions up to 1.0.1. The vulnerability enables attackers to circumvent authentication controls by leveraging an alternate path or channel, allowing unauthorized access. The CVSS 3.1 base score of 9.8 reflects the critical impact on confidentiality, integrity, and availability with no privileges or user interaction required and exploitable remotely over the network. The vulnerability is publicly disclosed but lacks available patches or vendor advisories detailing remediation steps. No evidence of exploitation in the wild has been reported to date.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls, potentially gaining unauthorized access to the affected system. This can lead to full compromise of sensitive data, unauthorized actions, and disruption of service. The critical CVSS score (9.8) indicates a severe impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported, and the affected product is not a cloud service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications closely. No specific temporary mitigations or workarounds are provided in the available data. Avoid deploying or using the affected versions if possible, or restrict access to the affected addon to trusted users only.