The vulnerability is a Missing Authorization flaw (CWE-862) in the Webba Booking plugin, allowing an attacker to bypass intended access controls and perform unauthorized actions on booking management functions. security levels, enabling the exploitation of the plugin’s endpoints without proper permission checks. As a result, attackers could potentially view, modify, or delete bookings and associated data.

The affected product is the Webba Booking plugin from Webba Plugins, versions from n/a through 6.4.13. Any WordPress site installing any of these versions is susceptible until an update to 6.4.14 or later is applied.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS data is not available. Based on the description, it is inferred that the attack vector is via HTTP requests to the plugin’s endpoints, potentially exploitable by authenticated users with limited roles. The lack of an EPSS suggests a lower probability of automated exploitation at this time, but the presence of unauthenticated or low‑privilege access could still pose a risk.