This vulnerability, identified as CWE-862 (Missing Authorization), affects the WpBookingly plugin by Magepeople inc. It allows an attacker with low privileges to exploit improperly configured access control mechanisms, potentially leading to unauthorized modification of data or actions within the application. The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacting integrity only. The affected versions include all versions up to 1.2.9. No patch or official fix has been documented in the provided data.

The vulnerability impacts the integrity of the WpBookingly plugin by allowing unauthorized actions due to missing authorization checks. There is no impact on confidentiality or availability. No known exploits are currently reported, so the practical risk may be limited until exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in WpBookingly where possible. Limit user privileges to the minimum necessary to reduce potential exploitation impact.