The iGMS Direct Booking plugin for WordPress includes a missing authorization flaw that allows users to bypass the intended access controls. Because the vulnerability falls under CWE-862, it enables an attacker to read and potentially modify booking records that should be restricted. The impact is a direct compromise of the confidentiality and integrity of reservation data on affected sites.

WordPress sites that have installed any version of the iGMS Direct Booking plugin up to and including version 1.3 are affected. Site owners should verify the plugin version in the WordPress dashboard and take action if the installed release is 1.3 or older.

The CVSS score of 5.3 indicates a moderate impact, while an EPSS rating of less than 1 % suggests that exploitation is unlikely to occur frequently. The vulnerability is not listed in the CISA KEV catalog, further reducing the likelihood of widespread attacks. Based on the description, it is inferred that an attacker would need to target plugin endpoints that are meant to be restricted but lack proper role checks. If successful, the actor could use those points to gain unauthorized read or write access to booking information.