The Booking Package WordPress plugin contains a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint. Only a nonce is validated, and the dispatcher calls Schedule::updateUser() with the administrator argument hard‑coded to 1. This bypasses the function’s owner‑restriction logic and allows an attacker to supply any user ID to wp_update_user(). This flaw, a classic example of CWE-639, gives authenticated users with Editor level access or higher the ability to change the email address or password of any account, including Site Administrators, effectively taking over the entire site. The flare is a privilege escalation that results in full control over the WordPress installation.

This vulnerability affects the Booking Package plugin for WordPress, specifically all versions up to and including 1.7.16. Users running this plugin on any WordPress site are at risk if they have been granted Editor or higher level permissions.

The flaw carries a CVSS score of 7.2, indicating a high severity. Although no EPSS score is available, the vulnerability is well known and has been reported in multiple public advisories, suggesting it is likely to be exploited by attackers who already have authenticated access. The attack vector is via a web interface: an authenticated user can trigger the vulnerable AJAX action. Because the risk includes full site takeover and the vulnerability is not mitigated by current role restrictions, the risk level remains high and warrants immediate action.