CVE-2026-62101 - Vulnerability Details - OpenCVE

Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Chris Åkerfeldt Wendel	Eduadmin Booking
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/eduadmin-booking/vulnerability/wordpress-eduadmin-booking-plugin-5-4-2-broken-authentication-vulnerability?_s_id=cve

History

Thu, 17 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Chris Åkerfeldt Wendel Chris Åkerfeldt Wendel eduadmin Booking Wordpress Wordpress wordpress
Vendors & Products		Chris Åkerfeldt Wendel Chris Åkerfeldt Wendel eduadmin Booking Wordpress Wordpress wordpress

Thu, 17 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 17 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
Title		WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability
Weaknesses		CWE-288
References		https://patchstack.com/database/wordpress/plugin/eduadmin-booking/vulnerability/wordpress-eduadmin-booking-plugin-5-4-2-broken-authentication-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2026-09-17T13:24:36.362Z

Updated: 2026-09-17T14:04:06.181Z

Reserved: 2026-07-13T06:15:04.989Z

Link: CVE-2026-62101

Vulnrichment

Updated: 2026-09-17T14:04:00.907Z

NVD

Status : Deferred

Published: 2026-09-17T14:17:14.977

Modified: 2026-09-17T21:12:30.593

Link: CVE-2026-62101

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62101", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-07-13T06:15:04.989Z", "datePublished": "2026-09-17T13:24:36.362Z", "dateUpdated": "2026-09-17T14:04:06.181Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-17T13:24:36.362Z"}, "title": "WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-50", "descriptions": [{"lang": "en", "value": "CAPEC-50 Password Recovery Exploitation"}]}], "affected": [{"vendor": "Chris \u00c5kerfeldt Wendel", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "eduadmin-booking", "product": "EduAdmin Booking", "versions": [{"lessThanOrEqual": "5.4.2", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "6.0.0", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions."}], "value": "Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/eduadmin-booking/vulnerability/wordpress-eduadmin-booking-plugin-5-4-2-broken-authentication-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress EduAdmin Booking Plugin to the latest available version (at least 6.0.0)."}], "value": "Update the WordPress EduAdmin Booking Plugin to the latest available version (at least 6.0.0)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "henise | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T14:02:27.490550Z", "id": "CVE-2026-62101", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T14:04:06.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-17T14:02:27.490550Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T14:04:00.907Z"}}], "cna": {"title": "WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "henise | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-50", "descriptions": [{"lang": "en", "value": "CAPEC-50 Password Recovery Exploitation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Chris \u00c5kerfeldt Wendel", "product": "EduAdmin Booking", "versions": [{"status": "affected", "changes": [{"at": "6.0.0", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "5.4.2"}], "packageName": "eduadmin-booking", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress EduAdmin Booking Plugin to the latest available version (at least 6.0.0).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress EduAdmin Booking Plugin to the latest available version (at least 6.0.0).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/eduadmin-booking/vulnerability/wordpress-eduadmin-booking-plugin-5-4-2-broken-authentication-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.", "supportingMedia": [{"type": "text/html", "value": "Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-17T13:24:36.362Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62101", "state": "PUBLISHED", "dateUpdated": "2026-09-17T14:04:06.181Z", "dateReserved": "2026-07-13T06:15:04.989Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-09-17T13:24:36.362Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}