The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels in the Booking and Rental Manager plugin for WordPress. An attacker can perform actions intended for higher-privilege users, potentially changing booking data, viewing sensitive information, or manipulating rental configurations. The weakness is a classic Missing Authorization failure (CWE‑862).

The flaw affects the magepeopleteam Booking and Rental Manager plugin for WooCommerce, specifically all installations using version 2.2.1 or earlier; earlier versions are also potentially impacted. Operators running the plugin on WordPress sites are the directly affected systems.

The CVSS score of 5.8 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of active exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via the web application, where an unauthenticated or low‑privilege user can reach a management endpoint that does not properly enforce access controls. Exploitation would require gaining unauthorized access to privileged actions such as editing or deleting bookings.