The vulnerability in the Booking Package WordPress plugin before version 1.7.31 stems from the absence of any authorization or validity check before resetting the premium subscription state. An unauthenticated attacker can call the subscription deactivation endpoint and cause the plugin to disable its paid features, effectively denying service to legitimate subscribers and potentially undermining the plugin’s revenue model.

This issue affects all installations of the Booking Package plugin with a version lower than 1.7.31. Site owners who have not upgraded the plugin are at risk.

The CVSS score is 5.3, the EPSS score is less than 1%, and the lack of an authentication check means an attacker can execute the vulnerability from any location without credentials. The vulnerability is not listed in the CISA KEV catalog, and no known exploits are currently documented. The overall risk is moderate to high for websites that rely on the plugin’s paid functionality.