The WP Time Slots Booking Form plugin contains a missing authorization flaw that allows an attacker to bypass access controls and invoke functionality that should be restricted to privileged users. The vulnerability is classified as CWE-862: Missing Authorization. No explicit details are provided in the CVE about the data or resources that could be compromised beyond the ability to use those protected functions.

WordPress sites hosting the codepeople WP Time Slots Booking Form plugin version 1.2.42 or any earlier release are affected. The vendor is codepeople and the product is WP Time Slots Booking Form. No specific sub‑version details are supplied beyond the maximum affected version listed.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score below 1% suggests a low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. The description indicates the flaw arises from incorrectly configured access control levels; therefore, the likely attack vector would involve submission of crafted HTTP requests to the plugin’s protected endpoints. This path is inferred from the nature of the vulnerability rather than explicitly detailed.