The vulnerability in the WordPress Webba Booking plugin (versions up to 6.5.4) is a missing authorization flaw that allows users to bypass intended access restrictions. Because the plugin does not enforce proper access control, an attacker can read, modify, or delete booking information that should be protected. The weakness corresponds to CWE-862, indicating that the system fails to restrict actions to authorized users. This flaw can lead to integrity and confidentiality violations, and, depending on the plugin’s capabilities, could be leveraged to disrupt booking workflow.

Affected systems are WordPress sites that have the Webba Booking (webba-booking-lite) plugin installed, with versions from the initial release through 6.5.4. The vendor, Webba Plugins, acknowledges the issue in all plugin releases up to and including 6.5.4. Users running any of these versions should check their installation and prepare to upgrade.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Likely attack path is through the plugin’s web interface, where an authenticated or possibly unauthenticated attacker can perform privileged actions. No exploit code requirements are given in the advisory, but the broken access control suggests that no special conditions are needed beyond interacting with the plugin’s normal interfaces.