Unauthenticated users can exploit a flaw in WordPress WP BASE Booking versions 5.9.0 and earlier to elevate privileges. The vulnerability stems from insufficient authentication checks, allowing attackers to gain administrative rights within the plugin and potentially the entire WordPress site. This leads to full control over booking data, configuration, and possibly the underlying WordPress environment.

The issue affects the WP BASE Booking plugin developed by Hakan Ozevin. All instances running version 5.9.0 or lower are susceptible. Upgrading to the latest release (6.0.0 or newer) removes the flaw.

The CVSS score of 8.1 denotes a high severity. The EPSS score is below 1%, indicating a very low likelihood of widespread exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to send unauthenticated HTTP requests to the plugin; because the flaw permits privilege escalation without prior authentication, a lone attacker can compromise the site once the flaw is triggered.