The designthemes WeDesignTech Ultimate Booking Addon (versions up to 1.0.1) contains an authentication bypass vulnerability identified as CVE-2026-27390. This vulnerability enables an attacker with some level of privileges (PR:L) to bypass authentication controls by leveraging an alternate path or channel, resulting in unauthorized access. The vulnerability is remotely exploitable (AV:N) without user interaction (UI:N) and affects confidentiality, integrity, and availability (C:H/I:H/A:H). No vendor patch or advisory details are currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication controls, leading to unauthorized access with full control over the affected system's data and operations. This compromises confidentiality, integrity, and availability of the system. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected addon and monitor for unusual authentication attempts. Avoid exposing the vulnerable addon to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.