The vulnerability is a missing authorization flaw that enables an attacker with access to the administration interface to modify plugin settings. This can lead to unauthorized configuration changes that could enable further malicious activity, such as redirecting users or enabling hidden features. The weakness is an access control failure (CWE‑862).

WordPress sites running designthemes’ Reservation Plugin, version 1.7 or earlier, are affected. Only installations of the plugin within this version range are vulnerable; newer releases are not impacted as per the vendor’s version range.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation has been documented. Based on the description, the likely attack vector is an authenticated user with sufficient privileges to access plugin settings—a privilege escalation scenario that does not require exploitation of an external interface. The impact is limited to the plugin’s configuration and does not directly compromise the underlying WordPress installation, but the resulting misconfiguration could be leveraged for further attacks.