The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control levels within the Court Reservation plugin. This flaw can enable users to perform actions beyond those they are permitted to, resulting in unauthorized activity and potential privilege escalation. The weakness is identified as CWE-862: Access Control Failure.

The affected product is the Court Reservation plugin for WordPress, released by webmuehle. All versions from the first release through 1.10.11 are vulnerable. Any WordPress site installing one of these versions is at risk.

Because the issue is a direct lack of authorization checks, an attacker can exploit the vulnerability by sending crafted HTTP requests to the plugin’s exposed endpoints; this attack vector is inferred based on the nature of the flaw. The CVSS score is not provided, so the precise severity is unknown, but broken access control often carries a high risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, leaving the exact exploitation probability uncertain but potentially moderate to high for sites that expose the plugin to the public web.