The vulnerability is an Insecure Direct Object Reference that allows an attacker to supply a user‑controlled key and bypass authorization controls. By manipulating the booking identifier, an authenticated or, likely, an unauthenticated attacker could view, modify, or delete other users’ reservation data. The extent to which unauthenticated access is possible is not explicitly documented, but the description suggests it could be possible; this is inferred. The weakness maps to CWE‑639, signifying that the application accepts user input without proper validation of permissions, leading to unauthorized data access.

WordPress sites that use the Webba Booking Lite plugin from earlier than version 6.5.3. The flaw exists in all releases up to 6.5.2 inclusive, regardless of configuration.

The CVSS score of 7.5 reflects a Medium‑High risk, while the EPSS score of less than 1% indicates that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can exploit it by sending crafted HTTP requests that include a malicious booking ID without requiring privilege escalation beyond the target user’s session; this makes it a readily actionable flaw for anyone who can reach the plugin’s endpoints.