Missing authorization in the nicdark Hotel Booking WordPress plugin allows an attacker to access booking data and potentially modify or delete reservations. The vulnerability stems from incorrectly configured access control security levels and is classified as CWE-862, which targets improper enforcement of operational policies.

The plugin hostname nicdark Hotel Booking, version 3.8 and all earlier releases are affected. The issue is present in the WordPress plugin distribution and is not limited to any specific host or server configuration beyond the WordPress site that hosts the plugin.

The CVSS score of 5.3 indicates a medium severity flaw; the EPSS score of less than 1% suggests that exploitation is unlikely but still possible. Because the flaw requires the ability to send web requests to a WordPress site that hosts the plugin and is not listed in the CISA KEV catalog, the attack vector is inferred to be via the web interface, potentially by authenticated users with low privileges or by unauthenticated users if the plugin endpoints do not enforce proper checks. Consequently, the risk is moderate, but the impact of unauthorized data disclosure or modification remains significant to affected administrators.