The plugin fails to restrict a user‑creation action, letting any authenticated user with Subscriber or higher privileges create a new administrator account. This lack of proper access control allows an attacker to elevate their permissions to a full site administrator, compromising confidentiality, integrity, and availability of the WordPress installation.

WordPress sites running the WP BASE Booking of Appointments, Services and Events plugin version 6.5.0 or earlier. Users with Subscriber level and above are vulnerable. The issue was fixed in version 6.5.1.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score is not provided in the public data. Nevertheless, the potential for creating administrator accounts presents a high‑severity risk. The exploit requires only that the attacker be authenticated and possess Subscriber or higher role; no additional vectors or conditions are described.