This vulnerability is a missing authorization flaw in the WordPress Pinpoint Booking System plugin that allows an attacker to access functions or data that should be protected, due to incorrectly configured access control security levels. The weakness permits unauthorized use of access controls, potentially exposing sensitive booking information or enabling operations that should be restricted to privileged users.

The defect affects the Pinpoint Booking System plugin for WordPress, from the earliest available version through 2.9.9.7.2. Any WordPress site that has this plugin installed in a vulnerable version is subject to risk.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves remote interaction via HTTP requests that target the plugin's endpoints without proper role checks; the specific exploitation details are not disclosed but are implied by the missing authorization mechanism.