This vulnerability allows an attacker with Subscriber privileges or higher to update the Bookly plugin to the most recent version without a proper authorization check. Because the update process overwrites the main plugin file, the attacker can replace or modify critical code, potentially inserting malicious scripts or backdoors. The flaw therefore threatens the integrity of the website’s code base and may serve as a foothold for broader compromise.

WordPress sites that use the ladela product Online Scheduling and Appointment Booking System – Bookly plugin, version 27.2 or earlier. Users of this plugin who lack administrative control will be affected by the missing capability check that permits plugin updates from any authenticated role.

The CVSS score of 5.4 places this flaw in the moderate range. No EPSS score is available and the issue is not listed in CISA’s KEV. An attacker must have valid login credentials and be at least a Subscriber to exploit it. Once the plugin is updated, the compromised code could lead to remote code execution or further privilege escalation depending on the attacker’s goals and the site’s overall security posture.