EduAdmin Booking
EduAdmin Booking has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Improper Authentication, behind 1 of the records (33%). Other recurring categories include PHP Remote File Inclusion, SQL Injection.
Every one of the 3 issues recorded for EduAdmin Booking has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. EduAdmin Booking is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2024-54373EduAdmin Booking <= 5.2.0 - Authenticated (Contributor+) Local File Inclusion
Read the full analysisVulnerability Records
EduAdmin Booking
Author
Chris Åkerfeldt Wendel
Plugin that you connect to EduAdmin to enable bookings of both courses and programmes through your website. Requires the following PHP-modules php-curl php-mbstring How can I report security bugs? You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C