CVE-2026-27390
Published: 05 March 2026
Summary
CVE-2026-27390 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediating the specific authentication bypass flaw in the WeDesignTech Ultimate Booking Addon plugin directly prevents exploitation of the alternate path vulnerability.
Enforcing approved authorizations for all logical access paths comprehensively blocks authentication bypass via alternate channels in plugins.
Restricting low-privileged users to only necessary privileges limits the impact of account takeover even if the bypass is exploited.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Auth bypass/account takeover in public-facing WordPress plugin directly enables T1190 (exploit public-facing app), T1068 (priv esc from low-priv auth user), and T1078 (valid account takeover).
NVD Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
Deeper analysisAI
CVE-2026-27390 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the WeDesignTech Ultimate Booking Addon WordPress plugin (wedesigntech-ultimate-booking-addon). This issue affects all versions from n/a through 1.0.1 and allows Authentication Abuse. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
Low-privileged authenticated users (PR:L) can exploit this vulnerability remotely over the network without requiring user interaction. Successful exploitation enables account takeover, granting attackers high-level access to compromise confidentiality, integrity, and availability of affected systems.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wedesigntech-ultimate-booking-addon/vulnerability/wordpress-wedesigntech-ultimate-booking-addon-plugin-1-0-1-account-takeover-vulnerability?_s_id=cve provides further details on this account takeover vulnerability, including potential mitigation guidance.
Details
- CWE(s)