This vulnerability (CVE-2024-31296) in BookingPress is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It allows an attacker with some privileges to bypass authorization checks by manipulating a user-controlled key parameter. The vulnerability affects BookingPress versions through 1.0.81. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low complexity, requiring privileges, no user interaction, unchanged scope, and limited confidentiality impact. No patch or official remediation level has been disclosed by the vendor as of the publication date.

An attacker with limited privileges could exploit this vulnerability to bypass authorization controls, potentially gaining access to resources or functions not intended for their role. The impact is limited to confidentiality with no effect on integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations have been provided by the vendor at this time.