The BookingPress WordPress plugin suffers from an External Control of File Name or Path vulnerability (CWE-73) that enables authenticated attackers with low privileges (Subscriber and above) to perform arbitrary file read and arbitrary file creation. Exploitation occurs through the 'bookingpress_save_lite_wizard_settings_func' function, allowing attackers to write files containing contents from local or remote sources. This can result in remote code execution or data disclosure. The vulnerability affects all plugin versions up to and including 1.1.5. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers with minimal privileges to create arbitrary files on the server, potentially leading to remote code execution and full compromise of the affected system. Confidentiality, integrity, and availability of the server and hosted data are all at high risk. This vulnerability can expose sensitive information and enable execution of malicious PHP code.

No official patch or fix is currently confirmed or available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible to mitigate risk.