A missing authorization check in the WordPress WpBookingly plugin allows an attacker to perform actions that should be restricted to privileged users. The vulnerability enables incorrect access to plugin functionality, potentially exposing data or allowing unauthorized modification of booking or service information. The weakness is classified as CWE‑862 (Missing Authorization).

The flaw affects installations of the Magepeople inc. WpBookingly plugin up to version 1.2.9 on WordPress sites. Any site running a vulnerable plugin version is susceptible, regardless of the WordPress core version. The impact could span single deployments to large multi‑site WordPress installations that rely on this booking manager.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no known public exploits at the time of assessment. The attack vector is likely remote via the web interface of the plugin, allowing an attacker who can reach the plugin’s endpoints to trigger the broken access controls without needing special privileges. The risk is amplified on sites where the plugin’s administrative pages are open to unauthenticated or low‑privilege users.