The Bookify plugin for WordPress contains an incorrect privilege assignment flaw that allows a user with lower permissions to obtain higher privileges. This weakness, classified as CWE-266, can enable an attacker to perform administrative actions.

The vulnerability is present in the Bookify plugin developed by Saad Iqbal. All released versions up through and including 1.0.9 are affected; earlier, undocumented releases may also contain the flaw.

The CVSS score of 8.8 indicates a high severity impact. While the EPSS score is currently below 1%, implying a low probability of exploitation at this time, the vulnerability remains a serious risk due to its potential to grant administrative control. The plugin is not listed in the CISA KEV catalog, yet the risk is elevated by the nature of the privilege escalation. The attack vector is inferred to involve authenticated access through the plugin’s front‑end or back‑end interfaces; a user with any existing role could potentially abuse the flaw to increase privileges. No public exploitation of this flaw has been reported, but its high score warrants prompt remediation.