The vulnerability is an improper authorization flaw that permits users without sufficient privileges to access or modify resources managed by the Booktics plugin. An attacker could read sensitive booking data, create, edit, or delete bookings, or otherwise manipulate plugin functionality if they can reach the affected endpoints.

The WordPress Booktics plugin, developed by Arraytics, is affected in all releases up to and including version 1.0.28. Any WordPress site installing this plugin at a patch level lower than 1.0.29 is potentially vulnerable.

The flaw is due to missing role checks in the plugin code, enabling an attacker to invoke the plugin’s endpoints through standard HTTP requests. The CVSS score of 5.4 indicates moderate severity, and no EPSS score is available, while the vulnerability is not listed in CISA’s KEV catalog. Consequently, the risk is moderate, primarily because the breach would allow unauthorized access to booking information or manipulation of booking data, but the lack of publicly known exploits reduces the likelihood of immediate exploitation.