The Booking & Appointment Plugin for WooCommerce contains an improper authorization vulnerability (CWE-285) in the 'save_google_calendar_data' function. This function lacks a proper capability check, allowing authenticated users with low privileges (subscriber-level or above) to update site options arbitrarily. This can lead to unauthorized modification of critical site configuration data. The vulnerability affects all versions up to 6.9.0. There is no vendor advisory or patch information available at this time. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows authenticated users with subscriber-level permissions or higher to modify site options arbitrarily. This can compromise the integrity and availability of the affected WordPress site and potentially expose sensitive configuration data. The high CVSS score (8.8) indicates a severe impact on confidentiality, integrity, and availability if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to site option changes. Avoid granting subscriber or higher permissions to untrusted users. Follow updates from Tyche Softwares for any forthcoming patches or official mitigations.