This vulnerability arises from missing authorization checks in the Webba Booking plugin for WordPress, allowing an attacker with knowledge of the plugin’s endpoints to bypass restricted access and potentially access or modify booking data. The weakness is classified as CWE‑862, a broken access control flaw. The impact is a loss of confidentiality, integrity, and availability of booking information for the affected WordPress installation.

The vulnerability affects the Webba Appointment Booking:Webba Booking plugin up to and including version 5.1.20. Any WordPress site that installs or upgrades the plugin before correcting the access control issue is in scope. The problem does not appear to affect other plugin versions or other WordPress components.

The CVSS score of 6.5 marks this as a medium‑severity flaw, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. However, because the weakness occurs in a widely used WordPress plugin, the risk is still a concern for sites that rely on this software. The flaw is not listed in the CISA KEV catalog, but a remote attacker could exploit it by making requests to the plugin’s REST or AJAX endpoints without proper authentication, assuming the site lacks additional restrictions or patching.