Missing authorization in Iqonic Design WPBookit 1.0.7 allows users without proper permissions to call privileged functions. This broken access control can let an attacker view or modify data that should be protected, exposing sensitive information and potentially enabling further attacks. The vulnerability corresponds to CWE‑862 – Missing Authorization.

Sites running Iqonic Design's WPBookit plugin version 1.0.7 or earlier on WordPress. The plugin is available in the free WordPress plugin repository and the issue affects all releases from the first version up through 1.0.7. Any WordPress installation that has not updated beyond this version is vulnerable.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of analysis. The flaw can be exploited through the web interface, targeting exposed plugin endpoints that lack proper ACL checks. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation.