The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels within the Hotel Listing plugin. This flaw is identified as CWE-862 and can lead to unauthorized modification or viewing of protected plugin settings and potentially sensitive data stored by the plugin. The impact is the compromise of data integrity and confidentiality for sites that rely on the plugin to manage hotel listings.

The affected product is the WordPress Hotel Listing plugin developed by e-plugins. All releases from the initial version up to and including 1.4.2 are impacted. Site administrators should verify the installed plugin version and consider upgrading if they are still using a vulnerable release.

The CVSS score of 7.3 indicates a high severity risk, while the EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Inferred, attackers could exploit the flaw remotely over the web by accessing the plugin’s administrative endpoints without proper capability checks, potentially allowing data tampering or unauthorized information disclosure. No specific exploit code is publicly known, but the flaw could be leveraged by automated scanners or targeted attackers who have discovered the exposed endpoints.