This vulnerability, identified as CWE‑862 Missing Authorization, allows an attacker to change the settings of the Eagle Booking plugin within WordPress. By exploiting incorrectly configured access controls, an attacker can modify booking configurations, potentially altering pricing, availability, or other operational parameters. This change can lead to financial loss, service disruption, and a breach of user trust.

The issue affects the Eagle-Themes Eagle Booking plugin on WordPress installations running any version up to and including 1.3.4.3. Any site that has installed or upgraded the plugin within this version range is at risk.

The CVSS score of 5.4 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via authenticated access within the WordPress admin area or through tool‑based requests targeting the plugin’s settings endpoint. No publicly known exploits are documented, so the risk depends largely on the presence of privileged user accounts that have the capability to modify plugin configuration.