The vulnerability identified as CVE-2025-68005 affects the themewant Easy Hotel Booking plugin through version 1.9.2. It is caused by missing authorization checks, resulting in incorrectly configured access control security levels. This flaw could allow an attacker with low privileges to access sensitive information without proper authorization. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to sensitive information within the Easy Hotel Booking plugin. The confidentiality of data is impacted, but integrity and availability remain unaffected. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the Easy Hotel Booking plugin to ensure proper authorization enforcement. Monitor for vendor updates regarding patches or official mitigations.