CVE-2026-59541 describes a privilege escalation vulnerability in WP BASE Booking versions up to 6.3.1, where subscribers can improperly escalate their privileges due to incorrect privilege assignment (CWE-266). The CVSS v3.1 score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is network exploitable with low attack complexity and does not require user interaction. No known exploits are reported in the wild, and no vendor advisory or patch information is available at this time.

Successful exploitation allows an attacker with subscriber-level access to escalate privileges, potentially gaining administrative capabilities. This can lead to full compromise of the affected application, including unauthorized access to sensitive data, modification of content, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber access where possible and monitor for unusual privilege escalations. Avoid granting subscriber roles to untrusted users.