This vulnerability in Iqonic Design's WPBookit plugin is due to missing authorization checks, which permits unauthorized users to access certain functions that should be protected by ACLs. The affected versions include all releases up to 1.0.7. The CVSS score is 5.3 (medium), reflecting that the vulnerability is remotely exploitable without privileges or user interaction and impacts integrity but not confidentiality or availability. No patch or mitigation details are currently available from the vendor or other sources.

The vulnerability allows unauthorized users to perform actions that should be restricted, potentially leading to unauthorized modification of data or plugin functionality. There is no impact on confidentiality or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WPBookit plugin functionality by limiting user permissions and monitoring for unusual activity related to the plugin. Avoid exposing the plugin to untrusted users.