CVE-2024-12558 is a missing authorization vulnerability in the WP BASE Booking of Appointments, Services and Events WordPress plugin (versions up to 4.9.2). The export_db function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to export sensitive data from the database, including hashed administrator passwords. This vulnerability is identified as CWE-862 and has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation details have been provided by the vendor, and the plugin is not a cloud service.

An attacker with authenticated access at Subscriber level or higher can exploit this vulnerability to retrieve sensitive data from the database, such as hashed administrator passwords. This could potentially lead to further compromise if the hashes are cracked or reused. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for unusual access patterns related to the export_db function. Avoid granting Subscriber-level access to untrusted users. Follow updates from the plugin vendor for any forthcoming patches.