The vulnerability identified as CVE-2025-39541 affects the WP Simple Booking Calendar plugin for WordPress, specifically versions up to 2.0.13. It is characterized by missing authorization controls, which means that users with limited privileges may perform actions or access data that should be restricted. The CVSS 3.1 base score is 6.5, with the vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with low privileges can exploit this missing authorization to gain unauthorized access to sensitive information within the plugin's scope, potentially compromising confidentiality. There is no reported impact on data integrity or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to the plugin.