The vulnerability identified as CVE-2026-27390 affects the WeDesignTech Ultimate Booking Addon by designthemes, specifically versions up to and including 1.0.1. It allows an authentication bypass through an alternate path or channel, enabling attackers with some level of privileges to escalate their access or abuse authentication controls. The CVSS v3.1 base score is 8.8, indicating a high impact with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to unauthorized access to the booking addon’s functionality and data, potentially allowing attackers to manipulate bookings, access sensitive information, or disrupt service availability. The high CVSS score reflects the critical nature of the authentication bypass and its broad impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected addon and applying compensating controls to limit exposure.