This vulnerability in the vcita Online Booking & Scheduling Calendar WordPress plugin is due to missing authorization checks, which means certain actions or data may be accessible without proper permissions. The affected versions are from initial releases through 4.5.5. The CVSS score is 5.4 (medium), reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts. No patch or official fix information is currently available, and the plugin is not a cloud service.

The vulnerability allows an attacker with low privileges to perform actions or access resources without proper authorization, potentially leading to integrity and availability impacts on the affected WordPress plugin. Confidentiality is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict user privileges to minimize exposure. Monitor for vendor updates regarding patches or mitigations.