The vulnerability identified as CVE-2024-50425 affects the WP Booking System plugin by Roland Murg, allowing unauthorized disclosure of sensitive system information. This issue impacts versions up to 2.0.19.10. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges but no user interaction, and resulting in high confidentiality impact without affecting integrity or availability. No patch or official fix information is currently available, and the vulnerability has been publicly disclosed as of October 29, 2024.

An attacker with low privileges can remotely access sensitive system information that should be restricted, potentially aiding further attacks or reconnaissance. The confidentiality of the system is compromised, but integrity and availability remain unaffected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure by restricting access to the affected plugin and monitor for updates from Roland Murg. Avoid granting unnecessary privileges to users to reduce risk.