CVE-2026-6960 is a critical vulnerability in the BookingPress Appointment Booking Pro plugin for WordPress, affecting all versions up to 5.6. The issue arises from the lack of file type validation in the 'bookingpress_validate_submitted_booking_form_func' function, which enables unauthenticated attackers to upload arbitrary files to the server. This can potentially lead to remote code execution if exploited. The vulnerability requires the presence of a signature custom field in the booking form to be exploitable. No official fix or patch has been published as of the data provided.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical severity and ease of exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider removing or disabling the signature custom field in booking forms to prevent exploitation. Monitoring for suspicious file uploads related to this plugin is advisable. Avoid exposing the booking form publicly if possible until a patch is available.