CVE-2025-54040: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2025-54040 affects the WordPress plugin Webba Booking versions 5.1.20 and below. This security issue was discovered by researcher Hiro and was publicly disclosed on July 16, 2025. The vulnerability is classified as a Missing Authorization/Broken Access Control issue in the Appointment Booking & Scheduling Plugin (Wordfence Intel, Patchstack Database).

The vulnerability has been assigned a CVSS score of 6.5 (Medium severity), indicating a moderate level of risk. The issue stems from a broken access control problem, specifically related to missing authorization, authentication, or nonce token checks in certain functions. This could potentially allow unprivileged users to execute actions typically reserved for users with higher privileges (Patchstack Database).

The vulnerability is classified as moderately dangerous and is expected to become exploited. The broken access control issue could lead to unauthorized users gaining access to privileged functions within the Webba Booking plugin (Patchstack Database).

The vulnerability requires no authentication to exploit, making it particularly concerning. It was initially reported by Hiro (Code016Hiro) on June 15, 2025, and an early warning was sent to Patchstack customers on July 16, 2025 (Patchstack Database).

Users are advised to update to Webba Booking version 5.1.22 or later, which contains the fix for this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack Database).