The vulnerability identified as CVE-2025-39376 involves missing authorization controls in the QuanticaLabs Car Park Booking System for WordPress plugin, versions up to 2.6. This issue permits users with limited privileges to execute certain actions without proper authorization checks. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges but no user interaction, and impacts integrity without affecting confidentiality or availability. No official patch or vendor advisory is currently available, and no known exploits have been reported.

The impact of this vulnerability is limited to integrity, meaning unauthorized users could potentially modify data or perform restricted actions within the booking system. Confidentiality and availability are not affected. The medium severity rating reflects the moderate risk posed by this issue, especially in environments where user privilege separation is critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges carefully and monitor for unusual activity related to the booking system. Avoid granting unnecessary permissions to users and consider additional access controls at the WordPress level to mitigate risk.