The vulnerability is a missing authorization flaw in the WpTravelly tour‑booking‑manager plugin, classified as CWE-862 Missing Authorization. This allows an attacker to exploit incorrectly configured access control security levels. Because proper checks are absent, an unauthenticated or low‑privileged user could potentially access, view, modify, or delete booking data and related settings. This could lead to data compromise and operational disruptions, although the exact scope of permissible actions is not detailed in the advisory.

Magepeople inc. WpTravelly WordPress plugin, versions up to and including 2.3.5. The advisory specifically states that all releases from the earliest available version through 2.3.5 are affected; newer releases are not listed as vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely exploited issue at present. The likely attack vector is via the web interface of the affected WordPress site; a malicious actor with access to the plugin's administrative pages could exploit the missing authorization checks. The recommended remediation is to update the plugin to version 2.3.6 or later, which presumably resolves the access control flaw.