The vulnerability is a missing authorization flaw that allows an attacker to perform booking‑management actions without proper privilege verification. An attacker who can construct requests to the plugin can bypass role checks and gain unauthorized access to create, view, or delete bookings. The weakness is classified as CWE‑862, indicating an improper privilege‑granting issue that can expose confidential customer data and disrupt booking operations.

Magepeople Inc. offers the Booking and Rental Manager WordPress plugin for WooCommerce. Versions from the product's initial release up to 2.8.2 are affected. Upgrading to version 2.8.3 or later removes the flaw.

The CVSS score of 5.3 reflects moderate severity. No EPSS score is available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the plugin is exposed via web interfaces, and an attacker can craft requests to authorized endpoints without authentication or with insufficient privileges.