This vulnerability (CVE-2026-27409) in Webba Plugins Webba Booking is classified as CWE-862 (Missing Authorization). It arises from incorrect access control configurations that allow unauthorized actions. The affected versions include all versions up to 6.4.13. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to integrity. No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows unauthorized users to perform actions that should be restricted, potentially leading to integrity violations within the affected Webba Booking plugin. There is no impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates and avoid exposing vulnerable versions unnecessarily.