Unauthenticated broken access control in the WordPress Booking Activities plugin versions 1.16.48.1 and earlier allows an attacker who can access the site without login to invoke plugin API endpoints that should be restricted to authorized users. This flaw permits read, modify, or delete operations on booking data or administrative configuration, thereby compromising the integrity and confidentiality of the booking system. The weakness aligns with CWE‑862, which focuses on missing access control.

WordPress sites that have the Booking Activities plugin by the Booking Activities Team installed in version 1.16.48.1 or older. The exact affected range is any instance where the plugin is added to a WordPress installation and the version is less than or equal to 1.16.48.1.

The CVSS v3 score of 6.5 reflects a moderate severity vulnerability. Its EPSS value is less than 1%, suggesting a currently low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would likely exploit the flaw through standard HTTP requests to the plugin’s exposed endpoints, bypassing WordPress authentication mechanisms. The resulting access control bypass could directly lead to unauthorized data exposure or manipulation without any local privilege escalation or exploit code execution.