CVE Watch: 18 October 2026, a 9.1 authentication bypass in a booking plugin and an unauthenticated write into post metadata
A 9.1 authentication bypass in a booking plugin plus WordPress plugin access and file handling bugs.
A 9.1 authentication bypass in a booking plugin plus WordPress plugin access and file handling bugs.