CyberRota Analysis
Uzaktan istismar edilebilir olabilir.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Detected Signals
exploit remote code execution code execution
Note: these links are listed for security research and verification purposes only.
CVE
CVE-2026-6960
Severity
CRITICAL
CVSS
9.8
EPSS
0.67%
WordPress
Original NVD Description
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.