The vulnerability is a broken access control flaw that allows an attacker to bypass authorization checks and execute privileged actions within the Quick Restaurant Reservations plugin. This flaw maps to CWE‑862, indicating that users can perform operations they should not be permitted to perform. The impact is the potential for unauthorized creation, modification, or deletion of reservations, and possibly access to sensitive reservation data.

The affected product is the Quick Restaurant Reservations plugin by Alejandro, version 1.6.7 and all earlier releases. No other versions are known to be vulnerable.

The CVSS score of 5.3 reflects medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation under current conditions; the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves interacting with the plugin’s administrative or front‑end interfaces, where incorrect security level configuration can be leveraged by authenticated or unauthenticated users with sufficient access. No public exploit code is known, but the weakness could be combined with other attacks to facilitate broader compromise.