The vulnerability is an Insecure Direct Object Reference that allows any authenticated user with subscriber-level role or higher to modify the Booking Manager per‑user settings of other accounts. By crafting a request targeting another user's ID, an attacker can overwrite the target's plugin configuration, potentially redirect bookings or disrupt the plugin’s normal operation, thereby compromising the integrity of booking data.

The affected product is the Booking Manager WordPress plugin for any site that installs the plugin version prior to 2.1.21. The vulnerability exists in all builds before that release; no specific patch version beyond 2.1.21 is documented.

The CVSS score of 4.3 indicates a medium severity issue. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers must first authenticate to WordPress with a subscriber role or higher. The IDOR flaw allows them to send an HTTP request to the plugin’s settings endpoint with a target user ID. Once successful, any per‑user configuration can be overwritten.