Incorrect privilege assignment in the Booking Activities plugin allows an attacker with sufficient access to obtain higher privileges. The flaw resides in the way the plugin assigns or updates user roles, enabling privilege escalation when certain actions are performed. An attacker can potentially gain administrator privileges in the WordPress site, compromising confidentiality, integrity, and availability of the content and database.

The vulnerability affects the WordPress Booking Activities plugin from version 1.16.44 and earlier, developed by the Booking Activities Team. Any installation of this plugin running those versions is susceptible.

The CVSS base score is 8.1, indicating a high severity level. The EPSS score of less than 1% suggests a very low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves leveraging the plugin’s web interface within WordPress; the victim must be able to interact with the plugin’s role assignment functionality, which is typically available to users with at least Contributor level access.