The vulnerability is a missing authorization flaw in the WordPress Radius Booking — Booking Calendar for Appointments & Services plugin, allowing attackers to bypass configured access controls and act as an authorized user. This flaw leads to unauthorized viewing, editing or deletion of booking data and administrative settings, thereby compromising confidentiality and integrity of appointment information.

The affected product is Radius Booking — Booking Calendar for Appointments & Services developed by Mamunur Rashid. Versions from the earliest available through 1.0.20 are impacted. Any WordPress site running these plugin versions is vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, implying no widespread active exploitation has been documented. Attackers can exploit the flaw remotely by sending crafted HTTP requests to the plugin’s endpoints, assuming they can access the WordPress site. No exploitation pattern is provided beyond the need to trigger the vulnerable functionality, and patching is the only official remedy.