The Booking plugin for WordPress contains a missing authorization flaw that allows users to access functions that should be protected by access control lists. This type of vulnerability can enable an attacker to retrieve or modify content, settings, or data that the plugin or the site administrators intended to keep restricted. The flaw can lead to the disclosure of sensitive information or the manipulation of booking data, which directly affects the confidentiality and integrity of the site.

VonStroheim TheBooking plugin for WordPress, version 1.4.4 and all earlier releases. The issue is documented for all releases from the initial release up to and including 1.4.4.

The CVSS score of 7.3 reflects a high severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, further suggesting limited exploitation activity. The likely attack vector is inferred to be a web request that reaches the unprotected plugin endpoints; because no specific authentication requirement is mentioned in the description, the flaw may be exploitable by both authenticated and unauthenticated users, but the precise prerequisites are not detailed in the available information.