The vulnerability is an authentication bypass that allows an attacker to abuse alternate paths or channels within the WordPress WeDesignTech Ultimate Booking Addon plugin. By exploiting this flaw an attacker can gain unauthorized access and take control of a user account, leading to full compromise of the booking system. The weakness is identified as CWE-288, a classic authentication issue.

WordPress sites running the WeDesignTech Ultimate Booking Addon plugin version 1.0.1 or earlier are affected. The vulnerability applies to all installations of this plugin up to and including 1.0.1.

The CVSS score is 9.8, indicating a critical severity. The EPSS score is less than 1% suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely target exposed WordPress sites that have the vulnerable plugin installed, submitting crafted requests that bypass authentication. The lack of a publicly disclosed exploit means the risk is based on potential to develop a proof‑of‑concept rather than existing off‑the‑shelf payloads.