The vulnerability stems from incorrect privilege assignment within the iQonic Design WPBookit Pro WordPress plugin. An attacker who can exploit it can elevate their privileges, potentially granting themselves administrative rights. This weakness, categorized as CWE‑266, permits unauthorized escalation of authority, threatening the confidentiality, integrity, and availability of the affected site.

It applies to iQonic Design’s WPBookit Pro plugin version 1.6.18 and all earlier releases. Any WordPress installation that has a vulnerable version is at risk.

With a CVSS score of 8.8 the flaw is high severity, yet the EPSS score is under 1 % indicating a low current likelihood of exploitation. The vulnerability is not listed in CISA’s known exploited vulnerability catalog. Exploitation would typically be carried out via the WordPress administrative interface from a remote location, and would require an authenticated session or ability to manipulate the plugin’s code. Despite the low EPSS, the high severity warrants timely action.