CVE-2026-32561 is an incorrect privilege assignment vulnerability (CWE-266) affecting LiquidThemes Booking Hub versions up to 1.3.0. It allows a user with subscriber-level privileges to escalate their privileges, potentially gaining unauthorized administrative capabilities. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with subscriber privileges to escalate their access rights, leading to full compromise of the affected Booking Hub instance. This includes unauthorized access to sensitive data, modification of system settings, and disruption of service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for suspicious activity related to privilege escalation attempts.