The vulnerability lies in the Bookingor WordPress plugin through version 1.0.12, where authenticated AJAX actions are exposed without the proper capability or nonce checks. This flaw allows users with low privileges, such as subscribers, to trigger deletion requests that remove Bookingor data and potentially delete entire categories. The weakness is a missing authorization check, resulting in an unauthorized capability escalation that directly impacts data integrity and availability.

Any WordPress site running the Bookingor plugin, version 1.0.12 or earlier, is affected. The plugin does not specify additional dependencies, so simply identifying the plugin version is sufficient. Sites that rely on this plugin for booking functionality or category management are at risk.

The CVSS score of 6.5 indicates moderate severity; the EPSS score is below 1%, suggesting that exploitation events are currently rare but still possible. The vulnerability is not listed in the CISA KEV catalog, so it is not a known exploited vulnerability at this time. The attack vector is inferred to be through authenticated AJAX requests made by users who normally do not have the necessary privileges, meaning an attacker needs only a low‑privilege user account and the ability to send crafted requests to the plugin’s AJAX endpoint. Because no nonce is validated, the attacker can simply call the endpoint with the required parameters to delete data.