The vulnerability identified as CVE-2025-68569 affects the WP Time Slots Booking Form plugin by codepeople. It is caused by missing authorization checks, leading to incorrectly configured access control security levels. This allows users with limited privileges to perform actions that should require higher authorization. The affected versions include all versions up to and including 1.2.39. The CVSS 3.1 base score is 6.5 (medium), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation could lead to unauthorized access to sensitive information within the plugin's context, impacting confidentiality. There is no impact on integrity or availability. The vulnerability requires an attacker to have some privileges on the system but no user interaction is needed. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative interfaces to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who could exploit this vulnerability.