The vulnerability in the WordPress OwnerRez API Plugin up to version 1.2.6 allows users with subscriber privileges to bypass access controls, enabling them to invoke API endpoints that should be restricted. This broken access control, classified as CWE-862, can lead to unauthorized data exposure or manipulation of booking information, potentially impacting confidentiality and integrity of tenant data.

Affected parties are WordPress installations using the OwnerRez API Plugin version 1.2.6 or earlier. The plugin serves as an interface between WordPress and the OwnerRez booking system. Any site permitting subscriber role access via the plugin is vulnerable, regardless of the WordPress version.

The CVSS score of 6.3 indicates a moderate risk. EPSS is not available, and the issue is not listed in CISA KEV, suggesting no known widespread exploits at this time. Attackers would need to authenticate as a subscriber to exploit the flaw, but the broken controls could allow them to manipulate booking records. The likely attack vector is through the plugin’s API endpoints, accessed by authenticated users who are not authorized to perform those actions. Defenses include restricting API access and enforcing proper role checks.