Technical impact
Authentication Bypass Using an Alternate Path or Channel in the WeDesignTech Ultimate Booking Addon allows an attacker to abuse authentication controls and gain unauthorized access to user accounts. The vulnerability is a CWE-288 weakness that can enable attackers to assume legitimate user credentials, potentially leading to destructive actions, data exfiltration, or further compromise of the WordPress site.
Affected Systems
The flaw affects the WordPress plugin WeDesignTech Ultimate Booking Addon in any version up to and including 1.0.1. WordPress sites running these versions are at risk.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely but still possible. The exploit likely involves manipulating HTTP requests to bypass authentication checks, potentially via crafted URLs or API endpoints. Attackers would need the ability to send requests to the vulnerable plugin but do not require privileged access, making the vulnerability a moderate to high risk for exposed sites.
