The vulnerability is a missing authorization check within the WordPress Radius Booking plugin. An attacker who can access the plugin’s web endpoints can invoke privileged functions that are intended only for authorized users. This broken access control creates a risk of unauthorized modifications to booking appointments, potentially leading to data compromise or service disruption. The weakness is classified as CWE-862.

The affected product is the WordPress Radius Booking — Booking Calendar for Appointments & Services plugin, developed by Mamunur Rashid. Versions from the initial release (n/a) up through 1.0.20 are impacted. Any WordPress installation that has this plugin installed and shares the affected version range is vulnerable.

The CVSS score of 6.5 indicates medium severity. The EPSS score is not available, so the current exploitation probability is unknown. Based on the description, the vulnerability appears to allow unauthenticated or low‑privileged users to trigger privileged actions by accessing the plugin’s endpoints, indicating a remote attack vector through web requests. The vulnerability is not listed in the CISA KEV catalog, so while there is no evidence of current exploitation, the potential remains if an attacker can reach the plugin.