Cyber Resilience

CVE-2026-24371

Medium

Published: 22 January 2026

Published
22 January 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0015 5.0th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-24371 is a medium-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-24371 is a missing authorization vulnerability (CWE-862) in the BA Book Everything WordPress plugin (ba-book-everything) developed by bookingalgorithms. It enables exploitation of incorrectly configured access control security levels and affects all versions of the plugin up to and including 1.8.16. The issue was published on 2026-01-22 and carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with low complexity and limited impact primarily on integrity.

An attacker requires low privileges, such as those of a registered WordPress user (PR:L), to exploit this vulnerability over the network (AV:N) without user interaction (UI:N). Exploitation allows limited integrity impacts (I:L), such as unauthorized modifications to plugin data or settings due to inadequate access controls, while confidentiality and availability remain unaffected.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ba-book-everything/vulnerability/wordpress-ba-book-everything-plugin-1-8-16-broken-access-control-vulnerability?_s_id=cve details this broken access control issue in BA Book Everything version 1.8.16. Security practitioners should consult the advisory for recommended mitigations, such as applying available patches or hardening access controls.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote exploitation of the application by low-privileged authenticated users, matching T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-69311Shared CWE-862
CVE-2026-3266Shared CWE-862
CVE-2026-45438Shared CWE-862
CVE-2025-23477Shared CWE-862
CVE-2025-68834Shared CWE-862
CVE-2026-22663Shared CWE-862
CVE-2024-12544Shared CWE-862
CVE-2024-50967Shared CWE-862
CVE-2025-68059Shared CWE-862
CVE-2025-14070Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces authorization checks on plugin functions so that low-privilege WordPress users cannot perform unauthorized modifications to booking data or settings.

AC-6 Least Privilege partial match
prevent

Limits the privileges granted to registered users, reducing the attack surface that the missing authorization flaw exposes.

SI-2 Flaw Remediation partial match
prevent

Requires prompt installation of the vendor patch that corrects the broken access-control logic in ba-book-everything <= 1.8.16.

References