The vulnerability identified as CVE-2026-25444 in Magepeople inc.'s WpBookingly plugin is categorized under CWE-862 (Missing Authorization). It affects versions up to 1.2.9 and involves improper access control configuration, which could allow users with limited privileges to perform actions beyond their authorization. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but with integrity impact. There is no official patch or remediation level provided by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user action.

The vulnerability could allow an attacker with some level of privileges to perform unauthorized actions due to missing or incorrect authorization checks. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Magepeople inc.'s communications for updates. Until a patch is available, carefully review and restrict user privileges to minimize potential exploitation of this missing authorization vulnerability.