The plugin version 6.5.2 and earlier contains a flaw that permits a subscriber with a valid WordPress account to gain higher privileges within the WordPress installation. The vulnerability is a classic privilege escalation issue that can enable an attacker to alter or delete site data, modify plugin settings, or access restricted areas of the site. It is identified as CWE-266, indicating improper authorization control.

The affected product is the WP BASE Booking plugin for WordPress, developed by Hakan Ozevin. All installations using version 6.5.2 or older are potentially vulnerable; newer releases are not mentioned in the advisory. The problem is present in the plugin code that relies on the subscriber role to bypass permission checks.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, which suggests no known widespread exploitation at the time of reporting. Based on the description, the likely attack vector requires an authenticated subscriber account; an adversary could create or use an existing subscriber account to exploit the flaw and elevate privileges. After privilege escalation, the attacker could potentially carry out a range of actions that compromise the integrity and confidentiality of the site.