The updated CVE description indicates a missing authorization flaw in the Easy Hotel Booking plugin. This flaw allows a user without proper permissions to bypass the expected access controls and interact with protected booking endpoints. Such unauthorized access can lead to viewing, modifying, or deleting booking data and, potentially, taking over administrative functions, thereby compromising confidentiality, integrity, and availability of the booking system.

All instances of the themewant Easy Hotel Booking WordPress plugin up to and including version 1.9.2 are affected. The issue exists in every build from the initial release until the specified limit, with no safe versions below 1.9.2. Site owners should review their installed plugin version and compare it against the vendor’s changelog for a patched release.

The CVSS score of 6.5 indicates a medium severity while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability has not been listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote web-based exploit that does not require elevated privileges; accessing protected booking endpoints without proper authorization would be sufficient to trigger the flaw.