The vulnerability is a missing authorization flaw in the TuriTop Booking System WordPress plugin, allowing users to bypass role or capability checks and manipulate booking functionalities. Based on the description, the plugin’s booking endpoints do not verify that a requester has the proper privileges, which could expose sensitive booking data or permit tampering with appointments. The weakness is classified as CWE‑862: Missing Authorization.

The issue affects the TuriTop Booking System plugin for WordPress from the earliest available version up through version 1.0.10, regardless of earlier release identifiers. All sites that have installed the plugin within this version range are vulnerable, and the vendor responsible is TuriTop.

The CVSS score of 6.5 denotes moderate severity, while the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through unauthenticated or insufficiently authenticated web requests to the plugin’s booking URLs, which an attacker could use remotely. Because the flaw is a missing authorization check, any user who can send HTTP requests to booking endpoints could override normal access controls.