The vulnerability is caused by missing authorization checks in the Vertim Schedula Smart Appointment Booking plugin for WordPress. This broken access control allows an unauthenticated or low‑privileged user to invoke functionality that is intended for administrators. The result is unauthorized access to protected plugin features. The weakness is identified as CWE‑862. The CVE description does not detail the precise data or functions exposed, so the exact confidentiality, integrity or availability impact remains unclear, but typical implications of such flaws include unauthorized viewing or modification of appointment data or configuration settings.

The flaw exists in all releases of the Vertim Schedula plugin up to and including version 1.0. Any WordPress site that has installed this plugin during that period is potentially affected.

The CVSS score of 5.9 places the flaw in the moderate risk range. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The description does not specify the exact attack vector, but the plugin’s functionality is accessed via the WordPress web interface, implying that an attacker could potentially exploit the flaw remotely over HTTP. Because the issue is a missing authorization check, the exploitation requires only that the attacker can reach the plugin’s endpoints and that the plugin does not enforce role checks before processing requests.