PT-2026-42552 · WordPress · Bookingpress Pro

Published 2026-05-21 · Updated 2026-05-23 · CVE-2026-6960

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BookingPress Pro versions prior to 5.7

Description The BookingPress Pro plugin for WordPress allows unauthenticated attackers to upload arbitrary files to the server, which may lead to remote code execution. This occurs due to missing file type validation within the bookingpress validate submitted booking form func() function. Exploitation is only possible if a signature custom field has been added to the booking form.

Recommendations Update to a version later than 5.6. As a temporary workaround, remove the signature custom field from the booking form to prevent exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-6960

Affected Products

Bookingpress Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-6960 · Security Note
• https://twitter.com/OrizonCyber/status/2057589794180350058 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ed738dc5-7848-4b04-a3fd-317cc366acfa?source=cve · Note
• https://bookingpressplugin.com · Note
• https://twitter.com/ThreatAft/status/2058033971397832851 · Twitter Post
• https://twitter.com/CVEnew/status/2057783204124237925 · Twitter Post
• https://t.me/cveNotify/164612 · Telegram Post
• https://twitter.com/infoflowcloud/status/2057784973453599041 · Twitter Post